PrinterOn Enterprise Cross-Site Scripting Vulnerability

PrinterOn Enterprise is a secure cloud printing solution from PrinterOn Canada. The solution supports printing from laptops, desktops and mobile devices connected to printers. A cross-site scripting vulnerability exists in PrinterOn Enterprise version 4.1.4, which stems from a lack of proper...

CVE-2019-9622

eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by reading the user-data/save/backup.sql file...

CVE-2019-9588

There is an Invalid memory access in gAtomicIncrement located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to for example the pdftops binary. It allows an attacker to cause Denial of Service Segmentation fault or possibly have unspecified other impact...

Apache Jmeter Remote Code Execution Vulnerability

Apache Jmeter is the United States Apache Apache Software Foundation of a set of open source software written in Java language for stress testing and performance testing . A remote code execution vulnerability exists in Apache Jmeter versions 4.0 and 5.0. A remote attacker can exploit this...

PT-2019-6420 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to v4.8 Description: The issue is related to out-of-bounds memory accesses in the Linux kernel's netlabel component. There are two array out-of-bounds memory accesses, one in the cipso v4 map lvl valid function, th...

UBUNTU-CVE-2019-3824

A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-05296)

WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. WUZHI CMS version 4.1.0 cross-site scripting vulnerability, remote attackers can use the /index.php?m=attachment&f=imagecut&v=init URL's 'imgurl' parameter to use the vulnerability to inject...

Vembu StoreGrid Cross-Site Scripting Vulnerability

Vembu StoreGrid is a suite of enterprise-class data backup software from Vembu USA. A cross-site scripting vulnerability exists in several files in Vembu StoreGrid version 4.4.x, which can be exploited by a remote attacker to inject arbitrary Web script or HTML. The files include:...

Pluck Cross-Site Request Forgery Vulnerability (CNVD-2019-05782)

Pluck is a content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in Pluck version 4.7.9-dev1. A remote attacker can exploit this vulnerability to delete articles with /admin.php?action=deletepage&var1= URI...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-05295)

WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. WUZHI CMS version 4.1.0 in the existence of cross-site scripting vulnerability, a remote attacker can / index.php?m=core&f=map&v=baidumap URL 'x' and 'y' parameters to exploit the The...

CVE-2019-0259

SAP BusinessObjects, versions 4.2 and 4.3, Visual Difference allows an attacker to upload any file including script files without proper file format validation...

SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2019-04858)

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product has report generation, analysis, data visualization and other functions. A cross-site scripting vulnerability in SAP BusinessObjects Business...

SAP BusinessObjects Business Intelligence Platform Arbitrary File Upload Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product has report generation, analysis, data visualization and other functions. An arbitrary file upload vulnerability exists in SAP BusinessObjects...

CVE-2018-19000

LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data...

UBUNTU-CVE-2018-16880

A flaw was found in the Linux kernel's handlerx function in the vhostnet driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the...

UBUNTU-CVE-2018-16889

Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable...

PT-2019-9383 · Ceph +3 · Ceph +3

Name of the Vulnerable Software and Affected Versions: Ceph versions up to v13.2.4 Description: The issue is related to the improper sanitization of encryption keys in debug logging for v4 auth, resulting in the leaking of encryption key information in log files via plaintext. Recommendations: Fo...

AZL-6520 CVE-2019-3819 affecting package kernel for versions less than 5.10.78.1-1

A flaw was found in the Linux kernel in the function hiddebugeventsread in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user "root" can cause a system lock up and a denial of service. Versions from v4.18 and newe...

OXID eSales SQL Injection Vulnerability

OXID eSales is a set of e-commerce content management system from OXID eSales, Germany. The system includes modules for B2C and B2B. A SQL injection vulnerability exists in the DB abstraction layer of OXID eSales version 4.10.6, which can be exploited by a remote attacker to execute SQL by sendin...

CVE-2019-0002

On EX2300 and EX3400 series, stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. When this issue occurs, the output of the command: show pfe filter hw summary will not show the entry for: RACL group Affected releases are...