CVE-2018-21029

systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication SNI is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname...

Apple iTunes and macOS CVE-2019-8801 DLL Loading Arbitrary Code Execution Vulnerability

Description Apple iTunes and macOS are prone to an arbitrary code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial of service condition. Technologies Affected Apple...

CVE-2019-4486

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164070...

CVE-2019-4486

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164070...

CVE-2019-4486

CVE-2019-4486 affects IBM Maximo Asset Management 7.6. The vulnerability is a cross-site scripting flaw that allows embedding arbitrary JavaScript in the Web UI, potentially leading to credential disclosure within a trusted session. Affected core version: Maximo Asset Management 7.6, with likely ...

IBM Cloud Orchestrator CVE-2019-4399 Information Disclosure Vulnerability

Description IBM Cloud Orchestrator is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. The following versions are vulnerable: IBM Cloud Orchestrator 2.5, 2.5.0.1, 2.5.0.2, 2.5.0.3,...

Intelbras IWR 1000N Cross-Site Request Forgery Vulnerability

Intelbras IWR 1000N is a wireless router from Intelbras Poland. A cross-site request forgery vulnerability exists in the Intelbras IWR 1000N. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could exploit th...

Apache HTTP Server Stack Overflow Vulnerability - Windows

Apache HTTP Server is prone to a stack overflow vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:httpserver"...

Unauthorized Access Vulnerability in Polaris Trusted Exchange Defense System

Jiangsu Jiyuan Information Technology Co., Ltd. is a high-tech enterprise dedicated to network security industry. There is an unauthorized access vulnerability in Jiyuan Trusted Exchange Defense System, which can be exploited by attackers to obtain sensitive information...

Authentication Bypass Vulnerability in the Management Interface of Citrix Application Delivery Controller and Citrix Gateway

Description of Problem A vulnerability has been identified in the management interface of Citrix Application Delivery Controller ADC formerly known as NetScaler ADC, and Citrix Gateway, formerly known as NetScaler Gateway, that, if exploited, could allow an attacker with access to the management...

Microsoft Visual Studio Code CVE-2019-1414 Local Privilege Escalation Vulnerability

Description Microsoft Visual Studio Code is prone to a local privilege-escalation vulnerability. An attackers may exploit this issue to gain elevated privileges. Technologies Affected Microsoft Visual Studio Code Recommendations Permit local access for trusted individuals only. Where possible, us...

JSS: OCSP policy "Leaf and Chain" implicitly trusts the root certificate

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle...

ISC BIND CVE-2019-6476 Remote Denial of Service Vulnerability

Description ISC BIND is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition. ISC BIND 9.14.0 through 9.14.6, and 9.15.0 through 9.15.4 are vulnerable. Technologies Affected ISC Bind 9.14.0 ISC Bind 9.14.1 ISC Bind 9.14.2 ISC...

Oracle Retail Xstore Office CVE-2018-3300 Remote Security Vulnerability

Description Oracle Retail Xstore Office is prone to a remote security vulnerability. This vulnerability can be exploited over the 'HTTP' protocol. The 'Internal Operations' component is affected. This vulnerability affects the following supported versions: 7.1 Technologies Affected Oracle Retail...

CVE-2018-10841

A flaw was found in glusterfs which can lead to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to...

Dell ImageAssist CVE-2019-3767 Local Information Disclosure Vulnerability

Description Dell ImageAssist is prone to a local information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. Versions prior to Dell ImageAssist 8.7.1.5 are vulnerable. Technologies Affected Dell ImageAssist 4.0.0.9 Dell...

CVE-2019-0192

A flaw was found in the Apache Solr's Config API, where it would permit the configuration of the JMX server via an HTTP POST request. An attacker could use this flaw to direct traffic to a malicious RMI server, and then trigger remote code execution or conduct further attacks. Mitigation Upgrade ...

CVE-2018-1131

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possibl...

Juniper Junos CVE-2019-0073 Local Insecure File Permissions Vulnerability

Description Juniper Junos is prone to a local insecure file-permission vulnerability. A local attacker can exploit this issue to access sensitive information stored in the file-system. The following versions of Junos are vulnerable. Juniper Junos 15.1X49 versions prior to 15.1X49-D180 Juniper Jun...

Juniper Junos CVE-2019-0061 Local Privilege Escalation Vulnerability

Description Juniper Junos is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to gain elevated privileges. The following versions of Juniper Junos are affected: Junper Junos 15.1X49 versions prior to 15.1X49-D171 and 15.1X49-D180 Junper Junos 15.1X53...