CVE-2019-1628 Cisco Integrated Management Controller Denial of Service Vulnerability

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an authenticated, local attacker to cause a buffer overflow, resulting in a denial of service DoS condition on an affected device. The vulnerability is due to incorrect bounds checking. An attacker could...

The vulnerability of the BIOS microprogramming software update tool for Cisco UCS Series C servers allows a hacker to install malicious BIOS microprogramming software on a vulnerable device.

The vulnerability of the Cisco UCS server microprogramming system’s BIOS update tool is related to insufficient checking of the firmware file. Exploiting this vulnerability allows an attacker to install malicious BIOS microprogramming on a vulnerable device by running the BIOS update tool with...

VulnCheck KEV: CVE-2013-5758

cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files...

VulnCheck KEV: CVE-2009-2765

httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI...

UBUNTU-CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

CVE-2019-12146

A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WSFTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized director...

PT-2019-12931 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.7 Description: An issue was discovered where the update server URL of com joomlaupdate can be manipulated by non Super-Admin users. Recommendations: For versions prior to 3.9.7, update to version 3.9.7 or later t...

PT-2019-2477 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue exists due to insufficient input validation on the host server of the Hyper-V hardware virtualization system in Windows. This allows a remote attacker to execute arbitrary...

RarmaRadio 'Server' Denial of Service Vulnerability

RarmaRadio is a free internet radio program. A denial of service vulnerability exists in RarmaRadio 'Server'. An attacker can exploit the vulnerability to launch a denial of service attack...

Cyrus IMAP Arbitrary Code Execution Vulnerability

Cyrus IMAP is a Unix and Linux-based operating system for supporting IMAP Interactive Mail Access Protocol protocol open source mail server . A security vulnerability exists in the CalDAV feature of httpd in Cyrus IMAP versions 2.5.x through 2.5.12 and 3.0.x through 3.0.9. A remote attacker could...

CVE-2018-19978

CVE-2018-19978 affects the Auerswald COMfort 1200 IP phone, firmware 3.4.4.1-10589. The vulnerability is a buffer overflow in the DHCP/PPPOE configuration web interface. An attacker authenticated as a simple user on the same network can trigger a crafted POST request to the web server (via the Ma...

CVE-2019-10965

In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution...

SUSE-SU-2019:14064-1 Security update for curl

This update for curl fixes the following issues: Security issue fixed: - CVE-2019-5436: Fixed a heap buffer overflow exists in tftpreceivepacket that receives data from a TFTP server bsc1135170...

ai.hyacinth.framework:core-service-config-server (=0.5.0), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=6.0.1 <=6.1.0-RC2) +12 more potentially affected by CVE-2019-3799 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.RELEASE <=2.1.1.RELEASE)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.RELEASE, =6.0.1, =6.0.1, =6.0.1, =Einstein.RELEASE, =2.1.0.RELEA...

mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols...

The vulnerability of the Apache Tomcat application server, related to the use of open redirection, allows attackers to compromise the integrity of the protected information.

The vulnerability of the default server servlet engine for Apache Tomcat is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...

The vulnerability of the Cisco AsyncOS operating system proxy server of Cisco Web Security Appliance allows a perpetrator to trigger a service failure.

The vulnerability of the Cisco AsyncOS operating system’s proxy server for Cisco Web Security Appliance products exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to cause service interruptions by sending corrupted HTTP or HTTPS requests t...

Cross-site scripting in Apache Archiva

In Apache Archiva before 2.2.4, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file...

USN-3973-1 isc-dhcp vulnerability

It was discovered that DHCP, when built with a mismatched external BIND library, incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause DHCP to crash, resulting in a denial of service...

U.S. Dept Of Defense: RCE on █████ via CVE-2017-10271

Summary: Happy Friday! The server at ██████ is vulnerable to CVE-2017-10271 "Oracle WebLogic Server Remote Command Execution". Description: The following request takes 12 seconds 12000 milliseconds to complete: POST /wls-wsat/RegistrationPortTypeRPC HTTP/1.1 Host: ██████████ Content-Length: 423...