undertow: Information leak in requests for directories without trailing slashes

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...

undertow: Information leak in requests for directories without trailing slashes

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...

CVE-2019-17511

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via logget.php, which could be used to discover the intranet network structure...

D-Link DIR-412 Authorization Issues Vulnerability

The D-Link DIR-412 is a wireless router from AUO D-Link of Taiwan, China. An authorization issue vulnerability exists in the D-Link DIR-412 A1-1.14WW version, which stems from a failure to ask for authentication on some web pages, and can be exploited by an attacker to gain access to the router's...

GHSA-W5R2-GVGF-MPM8 Improper Encoding or Escaping of Output and Injection in LibreNMS

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

undertow: Information leak in requests for directories without trailing slashes

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...

The vulnerability of the PayAction.class.php script of the software controller for centralized control of wireless networks by D-Link Central WiFi Manager CWM(100) allows a hacker to execute arbitrary code.

The vulnerability of the PayAction.class.php script of the software controller for centralized control of wireless networks by D-Link Central WiFi Manager CWM100 is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating...

The vulnerability of the /web/Public/Conn.php component of the software controller for centralized control of wireless networks in D-Link Central WiFi Manager CWM(100) allows a intruder to execute arbitrary code.

The vulnerability of the /web/Public/Conn.php component of the software controller for centralized control of D-Link Central WiFi Manager CWM100 relates to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute...

The vulnerability in the web-management interface of the Fortinet FortiNAC device allows a perpetrator to execute a cross-site scripting attack.

The vulnerability in the Fortinet FortiNAC network access control web interface relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2018-20662

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing...

Input validation

Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection...

The vulnerability of the Rack module in the Ruby programming language allows attackers to compromise data integrity.

The vulnerability of the Rack module in the Ruby programming language is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker to compromise the integrity of data...

The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, stems from the lack of protective measures taken against the website structure. This allows attackers to carry out cross-site scripting attacks.

The vulnerability of the CloudForms Management Engine software platform for managing virtual environments is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform a cross-site scripting attack remote...

The vulnerability of the Team Foundation Server and Azure DevOps Server software development tools lies in the lack of protective measures for the website structure, allowing attackers to execute cross-site scripting attacks.

The vulnerability of the Team Foundation Server and Azure DevOps Server software development tools is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform a cross-site scripting attack remotely...

openSUSE Security Update : opera (openSUSE-2019-2154)

This update for opera fixes the following issues : Opera was updated to version 63.0.3368.88 : - DNA-79103 Saving link to bookmarks saves it to Other bookmarks folder - DNA-79455 Crash at views::MenuController:: FindNextSelectableMenuItemviews::MenuItemView, int, views::...

OPENSUSE-SU-2019:2154-1 Security update for opera

This update for opera fixes the following issues: Opera was updated to version 63.0.3368.88: - DNA-79103 Saving link to bookmarks saves it to Other bookmarks folder - DNA-79455 Crash at views::MenuController:: FindNextSelectableMenuItemviews::MenuItemView, int, views::...

Foxit Studio Photo EPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Foxit Studio Photo TIFF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

The vulnerability of the platform for automating operations in healthcare institutions of the Russian Federation’s entity Tra: The lack of protection for the website structure allows attackers to carry out cross-site scripting attacks.

The vulnerability of the platform for automating operations in healthcare institutions of the Russian Federation’s Tra:Pharmaceutical supply relates to the failure to take measures to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor, operating remotely...

CVE-2019-10665

An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with...