D-Link DIR-412 Authorization Issues Vulnerability

The D-Link DIR-412 is a wireless router from AUO D-Link of Taiwan, China. An authorization issue vulnerability exists in the D-Link DIR-412 A1-1.14WW version, which stems from a failure to ask for authentication on some web pages, and can be exploited by an attacker to gain access to the router's...

PT-2019-4309

Name of the Vulnerable Software and Affected Versions D-Link DIR-412 version A1-1.14WW Description The issue concerns a lack of authentication requirements for certain web interfaces on the affected router. This allows an attacker to access the router's log file through the "log get.php" API...

GHSA-W5R2-GVGF-MPM8 Improper Encoding or Escaping of Output and Injection in LibreNMS

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

undertow: Information leak in requests for directories without trailing slashes

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...

Fortinet FortiNAC XSS

The vulnerability in the Fortinet FortiNAC network access control web interface relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

D-Link Central WiFi Manager Component Code Execution

The vulnerability of the /web/Public/Conn.php component of the software controller for centralized control of D-Link Central WiFi Manager CWM100 relates to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute...

D-Link Central WiFi Manager PayAction.class.php Code Execution

The vulnerability of the PayAction.class.php script of the software controller for centralized control of wireless networks by D-Link Central WiFi Manager CWM100 is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating...

CVE-2018-20662

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing...

Input validation

Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection...

PT-2019-14967

Name of the Vulnerable Software and Affected Versions Foxit PhantomPDF version 9.5.0.20723 Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The...

PT-2019-13269

Name of the Vulnerable Software and Affected Versions Foxit PhantomPDF version 9.5.0.20723 Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The...

PT-2019-13270

Name of the Vulnerable Software and Affected Versions Foxit PhantomPDF version 9.5.0.20723 Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The...

Team Foundation Server Azure DevOps Server XSS

The vulnerability of the Team Foundation Server and Azure DevOps Server software development tools is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform a cross-site scripting attack remotely...

CloudForms Management Engine XSS

The vulnerability of the CloudForms Management Engine software platform for managing virtual environments is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform a cross-site scripting attack remote...

Rack Module Data Compromise

The vulnerability of the Rack module in the Ruby programming language is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker to compromise the integrity of data...

PT-2019-6305

Name of the Vulnerable Software and Affected Versions Portainer versions prior to 1.22.1 Description The issue is related to a lack of protection for the web page structure, allowing for cross-site scripting XSS attacks. This could enable a remote attacker to conduct inter-site script attacks...

openSUSE Security Update : opera (openSUSE-2019-2154)

This update for opera fixes the following issues : Opera was updated to version 63.0.3368.88 : - DNA-79103 Saving link to bookmarks saves it to Other bookmarks folder - DNA-79455 Crash at views::MenuController:: FindNextSelectableMenuItemviews::MenuItemView, int, views::...

OPENSUSE-SU-2019:2154-1 Security update for opera

This update for opera fixes the following issues: Opera was updated to version 63.0.3368.88: - DNA-79103 Saving link to bookmarks saves it to Other bookmarks folder - DNA-79455 Crash at views::MenuController:: FindNextSelectableMenuItemviews::MenuItemView, int, views::...

Foxit Studio Photo EPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Foxit Studio Photo TIFF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...