Design/Logic Flaw

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed...

Malicious Package

hpmm is a malicious package. The package retrieves system information and uploads it to a remote server. It also downloads a file from a malicious server and executes it...

Insecure Access Controls

mediawiki/core uses insecure access controls. Unauthorized users are able to retrieve suppressed username or log in Special:EditTags information...

Xymon Daemon Gather Information

This module retrieves information from a Xymon daemon service formerly Hobbit, based on Big Brother, including server configuration information, a list of monitored hosts, and associated client log for each host. This module also retrieves usernames and password hashes from the xymonpasswd config...

CVE-2019-13050

CVE-2019-13050: Describes a DoS risk arising from the interaction between SKS keyserver network code (through SKS 1.2.0) and GNU Privacy Guard (GnuPG) up to 2.2.16, where a keyserver host reference on the SKS network may trigger a Certificate Spamming Attack leading to a persistent denial-of-serv...

CVE-2019-1622

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. The vulnerability is due to improper access controls for certain URLs on affected DCNM softwar...

CVE-2017-9386

The CVE-2017-9386 entry concerns Vera VeraEdge (1.7.19) and Veralite (1.7.481). A script file get_file.sh on the device allows a user to read files within the cmh-ext folder, but the filename parameter is not properly validated, enabling directory traversal outside /cmh-ext to read arbitrary file...

Design/Logic Flaw

Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact with the device: for example, send the "open door" command, download the users list which includes RFID codes and passcodes in cleartext, o...

The vulnerability of Intel processors, related to the microarchitectural data retrieval from non-cached memory (MDSUM), allows attackers to exploit this to disclose protected information.

The vulnerability of Intel processors is related to the microarchitectural data cache invalidation mechanism MDSUM. Exploiting this vulnerability can allow an attacker to disclose protected information...

CVE-2019-12276

A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made...

CVE-2019-10320

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS12 certificate...

Updated virtualbox packages fix security vulnerabilities

This update provies Virtualbox 6.0.8 that fixes the Microarchitectural Data Sampling MDS, also called ZombieLoad attack vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU. The fixed / mitigated issues are: Modern Intel microprocessors...

MGASA-2019-0172 Updated kernel-linus packages fixes security vulnerabilities

This kernel update provides the upstream 4.14.119 that adds the kernel side mitigations for the Microarchitectural Data Sampling MDS, also called ZombieLoad attack vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU. To complete the mitigatio...

MGASA-2019-0171 Updated kernel-tmb packages fixes security vulnerabilities

This kernel update provides the upstream 4.14.119 that adds the kernel side mitigations for the Microarchitectural Data Sampling MDS, also called ZombieLoad attack vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU. To complete the mitigatio...

CVE-2019-10919

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Attackers with access to port 10005/tcp could perform device reconfigurations and obtain project files from the devices. The system manual recommends to protect access to this port. The security vulnerabili...

CVE-2019-11336

Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password used when the TV is acting as an access point by using the Photo Sharing Plus application to execute a backdoor API command, a different vulnerability than CVE-2019-10886...

CVE-2019-11336

Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password used when the TV is acting as an access point by using the Photo Sharing Plus application to execute a backdoor API command, a different vulnerability than CVE-2019-10886...

eQ-3 AG Homematic CCU3 Password Hash Disclosure Vulnerability

The eQ-3 AG Homematic CCU3 is a set of home automation controls from the German company eQ-3 AG. A password hash disclosure vulnerability exists in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier versions. An unauthenticated attacker accessing the web interface could use...

CVE-2019-7745

CVE-2019-7745 affects JioFi 4 (JMR1140 Amtel_JMR1140_R12.07). A flaw in the CGI qcmap_web_cgi Page=GetWiFi_Setting allows remote attackers to read the wpa_security_key (Wi‑Fi password) from the device. Documented by NVD/Red Hat and corroborated by exploit‑DB entries; the vulnerability is exposure...

Information Disclosure

ntp is vulnerable to information disclosure. The vulnerability exists as the message digest key is retrievable from the flaw of the message authentication functionality of libntp...