Private Internet Access (PIA) VPN Client Arbitrary Code Execution Vulnerability (CNVD-2019-24218)

Private Internet Access PIA is a commercial VPN service operated by London Trust Media. An arbitrary code execution vulnerability exists in the London Trust Media Private Internet Access PIA VPN client version 1.0 for Windows. An attacker can exploit this vulnerability to execute arbitrary code a...

CVE-2019-12574

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The...

CVE-2019-10970

In Rockwell Automation PanelView 5510 all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later, a remote, unauthenticated threat actor with access to an affected PanelView 5510 Graphic Display, upon successful exploit, may boot-up the terminal and...

CVE-2019-10970

Rockwell Automation PanelView 5510 devices manufactured before 2019-03-13 that have not been updated to v4.003+ or v5.002+ are affected. A remote, unauthenticated attacker with access to the affected PanelView 5510 Graphic Display can exploit improper access control to boot the terminal and gain ...

CVE-2019-10970

In Rockwell Automation PanelView 5510 all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later, a remote, unauthenticated threat actor with access to an affected PanelView 5510 Graphic Display, upon successful exploit, may boot-up the terminal and...

CVE-2019-10351

Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10348

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Design/Logic Flaw

Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10348

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10351

Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

PT-2019-11750 · Jenkins · Jenkins Caliper Ci Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Caliper CI Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within job config.xml files on the Jenkins master or controller. These credentials can be accessed b...

WordPress Ninja Forms Plugin Path Traversal (CVE-2019-10869)

A directory traversal vulnerability exists in WordPress Ninja Forms plugin. Successful exploit allows an attacker to traverse the file system to access files and execute code...

The vulnerability of the information protection system against unauthorized access: The Strife NT, due to the lack of authentication mechanisms in critical functions, allows attackers to gain access to the file system.

The vulnerability of the information protection system against unauthorized access in the Strife NT system is related to the absence of authentication mechanisms in critical functions. Exploiting this vulnerability allows a malicious actor, operating locally, to gain access to the file system by...

The vulnerability of the DRIVER of the Information Protection System against unauthorized access—StratOS NT—allows a intruder to gain access to filesystem objects.

The vulnerability of the Data Protection System’s driver for unauthorized access, Strash NT, is related to the lack of access control over file system objects. Exploiting this vulnerability allows a malicious actor, operating locally, to gain access to file system objects by replacing the...

CVE-2019-7667

Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login...

CVE-2019-7667

Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login...

FaceSentry Access Control System 6.4.8 Remote Command Injection

Summary FaceSentry 5AN is a revolutionary smart identity management appliance that offers entry via biometric face identification, contactless smart card, staff ID, or QR-code. The QR-code upgrade allows you to share an eKey with guests while you're away from your Office and monitor all activity...

CVE-2019-1630 Cisco Integrated Management Controller Denial of Service Vulnerability

A vulnerability in the firmware signature checking program of Cisco Integrated Management Controller IMC could allow an authenticated, local attacker to cause a buffer overflow, resulting in a denial of service DoS condition. The vulnerability is due to insufficient checking of an input buffer. A...

Gain the Trust of Your Business Customers With SOC 2 Compliance

In today's business environment, data is what matters most. It matters to organizations that monetize it into operational insights and optimisations, and it matters the threat actors that relentlessly seek to achieve similar monetisation by compromising it. In the very common scenario in which...

Directory traversal

Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location dot-dot-slash notation to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java...