3993 matches found
CVE-2017-18372
CVE-2017-18372 affects the Billion 5200W-T TCLinux FW 7.3.8.0 v008 130603 router distributed by TrueOnline. The vulnerability is a command injection in the Time Setting function via tools_time.asp, exploitable through uiViewSNTPServer and requires an authenticated user. Authentication can be achi...
Improper Access Control
Oracle MySQL is vulnerable to improper access control. MySQL init script mishandles initialization of the database data directory and permission setting on the error log file allowing local attackers to escalate their privileges to root or cause a system crash...
F5 Networks BIG-IP : HTTP/2 ALPN vulnerability (K94563344)
The Traffic Management Microkernel TMMmay restart when a virtual server has an HTTP/2 profile with Application Layer Protocol Negotiation ALPNenabled and it processes traffic where the ALPN extension size is zero.CVE-2019-6619 Impact BIG-IP The Traffic Management Microkernel TMM generates a core...
Sierra Wireless AirLink ES450 ACEManager Embedded_Ace_Set_Task.cgi Permission Assignment Vulnerability
Summary An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSetTask.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a arbitrary setting writes, resulting in the unverified changes to any system setting. An...
Memory Corruption Vulnerability in dp2 Project File of Xinjie OP20 Screen Setting Tool
Wuxi Xinjie Electric Co., Ltd. is a well-known domestic enterprise focusing on the research, development and application of industrial automation products. A memory corruption vulnerability exists in the dp2 project file of the Xinjie OP20 screen setup tool, which can be exploited by attackers to...
CVE-2018-17287
In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation...
CVE-2019-11228
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress...
Design/Logic Flaw
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress...
CVE-2019-0683
An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'...
CVE-2018-1680
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 145236...
X (Formerly Twitter): Protected Tweets setting overridden by Android app
Summary: Protected Tweets setting overridden by Android app Description: The Android app overrides the "Protect your Tweets" setting set from outside the app in some cases when changing other settings. Steps To Reproduce: 1. Log in to an account with unprotected tweets on the Android app. 1. Log ...
CVE-2019-7440
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings aka a SetWiFiSetting request to cgi-bin/qcmapwebcgi...
Design/Logic Flaw
The Web manager aka Commander on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting...
CVE-2019-9725
The Web manager aka Commander on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting...
CVE-2019-9725
The CVE-2019-9725 entry describes a Persistent XSS flaw in the Web manager (Commander) of Korenix JetPort 5601 and 5601f devices, exploitable via the Port Alias field under Serial Setting. Affected component: Web UI; root cause: input in Port Alias not properly sanitized, enabling stored/reflecti...
CVE-2019-9725
The Web manager aka Commander on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting...
The vulnerability of the windowing system for building the graphical user interface of the xorg operating system in Astra Linux allows a hacker to alter the settings of the X-Session.
The vulnerability of the window system for creating a graphical user interface in the Astra Linux operating system’s xorg lies in an incorrect setting of the allow-user-xsession parameter in "/etc/X11/Xsession.options". Exploiting this vulnerability could allow a hacker to alter the default...
CVE-2019-8438
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting-site setting" of admin/index.php, aka sitename...