CVE-2019-3604 ePolicy Orchestrator Cloud update fixes multiple Cross-Site Request Forgery vulnerabilities

Cross-Site Request Forgery CSRF vulnerability in McAfee ePO legacy Cloud allows unauthenticated users to perform unintended ePO actions using an authenticated user's session via unspecified vectors...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in McAfee ePO legacy Cloud allows unauthenticated users to perform unintended ePO actions using an authenticated user's session via unspecified vectors...

Unauthorized Access To Storage Volumes

libglusterfs.so is vulnerable to unauthorized access to storage volumes. The vulnerability exists due to the fix introduced for CVE-2018-1112, allowing unauthenticated users to mount the storage volumes...

Apache CouchDB < 2.3.0 Remote Privilege Escalation Vulnerability - Linux

CouchDB is prone to a remote privilege escalation vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2018-17188

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

CVE-2018-17188

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

Design/Logic Flaw

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

CVE-2018-17188

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

Local File Inclusion (LFI)

rendertron is vulnerable to local file inclusion LFI attacks. The vulnerability exists due to the ability to include file:/// via alternative protocols which allows unauthenticated users to read local files...

CVE-2018-7833

An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where an unauthenticated user can send a specially crafted XML data via a POST request to cause the web server to become unavailable...

Local File Inclusion (LFI)

athlon1600/php-proxy-app is vulnerable to local file inclusion LFI attacks. The vulnerability exists due to the ability to include file:/// in the value of q, which allows unauthenticated users to read local files...

CVE-2018-19203

PRTG Network Monitor before 18.2.41.1652 allows remote unauthenticated attackers to terminate the PRTG Core Server Service via a special HTTP request...

WordPress WP GDPR Compliance Plugin Privilege Escalation

The Wordpress GDPR Compliance plugin use auxiliary/admin/http/wp/gdprcomplianceprivesc msf undefinedgdprcomplianceprivesc show actions ...actions... msf undefinedgdprcomplianceprivesc set ACTION msf undefinedgdprcomplianceprivesc show options ...show and set options... msf...

Nextcloud: Talk / spreed: Disclosure of Room names and participants for password protected rooms

CVSS ---- 5.3 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS isn't always as fine-grained as I'd like; personally, I would rate the issue somewhere between low and medium Description ----------- The API of the official spreed/talk extension reveals potentially sensitive information such...

CVE-2018-0061

A denial of service vulnerability in the telnetd service on Junos OS allows remote unauthenticated users to cause high CPU usage which may affect system performance. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81 on SRX Series; 12.3 versions prior to...

CVE-2018-0061 Junos OS: Denial of service in telnetd

A denial of service vulnerability in the telnetd service on Junos OS allows remote unauthenticated users to cause high CPU usage which may affect system performance. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81 on SRX Series; 12.3 versions prior to...

CVE-2018-0061

CVE-2018-0061 is a Denial of Service affecting Junos OS telnetd. The vulnerability allows remote unauthenticated users to cause high CPU usage and potential degradation of system performance. Affected Junos OS versions and build revisions are explicitly listed (e.g., 12.1X46 up to 12.1X46-D81 for...

Bayanno Hospital Management System 4.0 - Cross-Site Scripting

Bayanno Hospital Management System 4.0 - Cross-Site Scripting Exploit Title: Bayanno Hospital Management System 4.0 - Cross-Site Scripting Date: 2018-09-05 Software Link: https://codecanyon.net/item/bayanno-hospital-management-system/5814621 Exploit Author: Gokhan Sagoglu Vendor Homepage::...

CVE-2018-16591

FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service accounts, as well as the password for the protected "SMS" panel via /cgi-bin/smchangepassword.cgi and /cgi-bin/smsmschangepasswd.cgi...

CVE-2018-16591

CVE-2018-16591 affects FURUNO FELCOM 250 and FELCOM 500 devices. The issue allows unauthenticated users to change passwords for Admin, Log, and Service accounts, as well as the protected SMS panel via /cgi-bin/sm_changepassword.cgi and /cgi-bin/sm_sms_changepasswd.cgi. Documented impact is creden...