CVE-2018-20929

CVE-2018-20929 affects cPanel prior to version 70.0.23. The vulnerability is an open redirect via the /unprotected/redirect.html endpoint (SEC-392). The available connected documents confirm the issue and its target endpoint but do not provide further technical details, impact, exploit status, or...

The vulnerability of the eDocLib platform for storing and processing corporate data arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out cross-site scripting attacks.

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect the structure of its web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser by placing it in a speciall...

The vulnerability of the .NET SDK WebForm Viewer component, a software tool for report development with SAP Crystal Reports for Visual Studio, allows attackers to disclose protected information.

The vulnerability of the .NET SDK WebForm Viewer component, a software tool for report development with SAP Crystal Reports for Visual Studio, is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to disclose sensitive information, includin...

The vulnerability of D-Link DI-524 router’s microprogramming software lies in the lack of protective measures for the website structure, allowing attackers to inject arbitrary JavaScript code into the device’s web interface pages.

The vulnerability of D-Link DI-524 router’s microprogram code exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject JavaScript code into the device’s web interface pages. The web configuration files,...

The vulnerability of the central server of the VMware Connection server in the virtualization system of VMware Horizon allows a hacker to gain unauthorized access to protected information.

The vulnerability of the central server of the VMware Connection server in the VMware Horizon workstation virtualization system is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to...

The vulnerability of the Windows GDI component of the Windows operating system, which allows a hacker to compromise protected information

The vulnerability of the Windows GDI component in Windows operating systems is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created document or web page...

The vulnerability of the Windows GDI component of the Windows operating system, which allows a hacker to compromise sensitive information

The vulnerability of the Windows GDI component of the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created document or web page...

The vulnerability of the Windows GDI component of the Windows operating system, which allows a hacker to compromise sensitive information

The vulnerability of the Windows GDI component of the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created document or web page...

The vulnerability of Microsoft SharePoint Foundation software, which exists due to the lack of measures taken to protect the website structure, allows attackers to execute cross-site scripting attacks and compromise the confidentiality of protected information.

The vulnerability of Microsoft SharePoint Foundation software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute cross-site scripting attacks and compromise the confidentiality of protected information throu...

The vulnerability of the Team Foundation Server and Azure DevOps Server software development tools lies in the lack of protection for service data. This allows attackers to execute arbitrary code and compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of Team Foundation Server and Azure DevOps Server software lies in the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, thereby compromising the confidentiality, integrity, and accessibility of...

CVE-2019-0312

CVE-2019-0312 affects SAP NetWeaver Process Integration (PI). The vulnerability arises because several PI pages (SAP_XIESR 7.10–7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL 7.10–7.11, 7.30, 7.31, 7.40, 7.50) are not password protected. An attacker could access landscape information such as h...

The vulnerability of the PostgreSQL database management system lies in the lack of protection for operational data, which allows attackers to disclose sensitive information that should be protected.

The vulnerability of the PostgreSQL database management system is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...

CVE-2019-10849

Computrols CBAS 18.0.0 allows unprotected Subversion SVN directory / source code disclosure...

Carel pCOWeb B1.2.1 - Credentials Disclosure

Carel pCOWeb B1.2.1 - Credentials Disclosure Exploit Title: Carel pCOWeb - Unprotected Storage of Credentials Date: 2019-04-16 Exploit Author: Luca.Chiou Vendor Homepage: https://www.carel.com/ Version: Carel pCOWeb all versions prior to B1.2.1 Tested on: It is a proprietary devices:...

Carel pCOWeb Cross Site Scripting / Credential Disclosure

Exploit Title: Carel pCOWeb - Stored XSS Date: 2019-04-16 Exploit Author: Luca.Chiou Vendor Homepage: https://www.carel.com/ Version: Carel pCOWeb all versions prior to B1.2.1 Tested on: It is a proprietary devices: http://www.carel.com/product/pcoweb-card 1. Description: In Carel pCOWeb web page...

CVE-2019-12087

Samsung S9+, S10, and XCover 4 P9.0 devices can become temporarily inoperable because of an unprotected intent in the ContainerAgent application. For example, the victim becomes stuck in a launcher with their Secure Folder locked. NOTE: the researcher mentions "the Samsung Security Team considere...

PT-2019-11636 · Postgresql Global Development Group · Postgresql

Name of the Vulnerable Software and Affected Versions: Postgresql versions prior to 11.5 Postgresql versions prior to 10.10 Postgresql versions prior to 9.6.15 Postgresql versions prior to 9.5.19 Postgresql versions prior to 9.4.24 Description: The issue allows a superuser to write a password to ...

Unprotected Database Exposes Personal Info of 80 Million American Households

A team of security researchers has claims to have found a publicly-accessible database that exposes information on more than 80 million U.S. households—nearly 65 percent of the total number of American households. Discovered by VPNMentor's research team lead by hacktivists Noam Rotem and Ran Loca...

The vulnerability of Cisco Umbrella’s security cloud service arises from the lack of protection for website structures. This allows attackers to execute arbitrary code in users’ browsers or gain access to confidential information.

The vulnerability of Cisco Umbrella security service exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a user’s browser or gain access to confidential information through a specially craft...

The vulnerability of the win32k component of the Windows operating system, which allows a hacker to compromise the confidentiality of protected information

The vulnerability of the win32k component in the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability allows an attacker to compromise the confidentiality of protected information through a specially created application...