Information Disclosure

ntp is vulnerable to information disclosure. The vulnerability exists as the message digest key is retrievable from the flaw of the message authentication functionality of libntp...

KLA11475 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions. Below is a complete list of vulnerabilities: 1. An out-of-bounds read vulnerability in SQLite can be exploited to obtain sensitive...

CVE-2018-1360

A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses...

CVE-2019-11455

CVE-2019-11455 is a buffer over-read in Monit’s Util_urlDecode (util.c). Pre-fix versions are affected; multiple advisories note the issue alongside CVE-2019-11454. Ubuntu/Debian/Fedora and Mageia/NASL records indicate fixes in updated Monit packages across distros (e.g., Debian 9 stretch fix in ...

CVE-2019-11350

CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page...

Default credentials

CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page...

CVE-2019-11350

CVE-2019-11350 affects CloudBees Jenkins Operations Center 2.150.2.3. When an expired trial license exists, the proxy configuration page allows cleartext password storage and retrieval. This is documented across NVD and Red Hat notices for CVE-2019-11350. CVSSv3.0 shows a base score of 9.8 (CRITI...

[SECURITY] Fedora 28 Update: wget-1.20.3-1.fc28

GNU Wget is a file retrieval utility which can use either the HTTP or FTP protocols. Wget features include the ability to work in the background while you are logged out, recursive retrieval of directories, file name wildcard matching, remote file timestamp storage and comparison, use of Rest wit...

[SECURITY] Fedora 30 Update: wget-1.20.3-1.fc30

GNU Wget is a file retrieval utility which can use either the HTTP or FTP protocols. Wget features include the ability to work in the background while you are logged out, recursive retrieval of directories, file name wildcard matching, remote file timestamp storage and comparison, use of Rest wit...

Fedora Update for wget FEDORA-2019-9f891cd83a

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 29 Update: wget-1.20.3-1.fc29

GNU Wget is a file retrieval utility which can use either the HTTP or FTP protocols. Wget features include the ability to work in the background while you are logged out, recursive retrieval of directories, file name wildcard matching, remote file timestamp storage and comparison, use of Rest wit...

CVE-2019-7001

The CVE-2019-7001 entry concerns a SQL injection in the WebUI of IP Office Contact Center. The vulnerability affects all 9.x and 10.x IP Office Contact Center versions prior to 10.1.2.2.2-11201.1908. An authenticated attacker could retrieve or alter sensitive data related to other users on the sy...

Directory Traversal

servey is vulnerable to directory traversal. A lack of validation of the URL allows a remote attacker to retrieve system files by using the ../ characters...

WordPress 5.0.0 crop-image Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Crop-image Shell Upload', 'Description' = %q This module exploits a path traversal and a local file inclusion vulnerability on WordPres...

CVE-2019-6531

An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 or Software Version 1.1.13166 if the attacker is in an MITM position...

Design/Logic Flaw

An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 or Software Version 1.1.13166 if the attacker is in an MITM position...

CVE-2019-6531

Affected product: Kunbus PR100088 Modbus gateway (all versions prior to Release R02 / Software 1.1.13166). Issue: Information Exposure Through Query Strings in GET Request (CWE-598) allows an MITM attacker to retrieve passwords via an HTTP GET request. Impact: password exposure with high severity...

Portainer has an unspecified vulnerability

Portainer is a lightweight user management interface for managing Docker environments and Docker hosts. A security vulnerability exists in Portainer versions prior to 1.20.0. An attacker can exploit the vulnerability to retrieve stored LDAP certificates...

Veeam Availability Console 3.0 RESTful API backward compatibility

Challenge This article describes improved Veeam Availability Console v3 RESTful API functionality that may retrieve different data compared to previous versions. Cause /Jobs: LastRun or EndTime now returns 00:00:00.0000000 UTC, January 1, 0001 if the value is not populated in UI /HardwarePlans:...

Cisco RV320 Unauthenticated Diagnostic Data Retrieval

Advisory: Cisco RV320 Unauthenticated Diagnostic Data Retrieval RedTeam Pentesting discovered that the Cisco RV320 router still exposes sensitive diagnostic data without authentication via the device's web interface due to an inadequate fix by the vendor. Details ======= Product: Cisco RV320 Dual...