PT-2019-12307

Name of the Vulnerable Software and Affected Versions I, Librarian version 4.10 Description The issue is related to a security problem where an attacker can execute malicious scripts. This is achieved through the export files parameter in the "export.php" API endpoint. Recommendations For I,...

Suricata Out-of-Bounds Read Vulnerability

Suricata is a high-performance network intrusion detection IDS, intrusion prevention IPS and network security monitoring multi-threaded engine. An out-of-bounds read vulnerability exists in Suricata 4.0.4. The vulnerability stems from an integer overflow in DecodeENIPPDU in app-layer-enip-commmon...

PT-2019-8748 · Open Information Security Foundation · Suricata

Name of the Vulnerable Software and Affected Versions: Suricata version 4.0.4 Description: The issue arises from incorrect handling of the SSH banner parsing in Suricata. A malformed SSH banner can cause the parsing code to read beyond the allocated data due to the lack of a length check in the...

DEBIAN-CVE-2019-5421

Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The Devise::Models::Lockable class, more specifically at the incrementfailedattempts method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests c...

Sitemagic CMS Cross-Site Scripting Vulnerability

Sitemagic CMS is a scalable content management system CMS. A cross-site scripting vulnerability exists in the SMFiles/FrmUpload.class.php file in Sitemagic CMS v4.4, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'filename' parameter...

CleanMyMac X Elevation of Privilege Vulnerability

MacPaw CleanMyMac X is a cleaning tool dedicated to the macOS platform from MacPaw USA. The product is capable of removing junk files, history cache, logs, etc. from your computer. An input validation vulnerability exists in CleanMyMac X version 4.20, which stems from the program's inability to...

UBUNTU-CVE-2019-9878

There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase located in GfxState.cc in Xpdf 4.0.0, as used in pdfalto 0.2. It can be triggered by for example sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service Segmentation...

PrinterOn Enterprise Cross-Site Scripting Vulnerability

PrinterOn Enterprise is a secure cloud printing solution from PrinterOn Canada. The solution supports printing from laptops, desktops and mobile devices connected to printers. A cross-site scripting vulnerability exists in PrinterOn Enterprise version 4.1.4, which stems from a lack of proper...

CVE-2019-9622

eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by reading the user-data/save/backup.sql file...

CVE-2019-9588

There is an Invalid memory access in gAtomicIncrement located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to for example the pdftops binary. It allows an attacker to cause Denial of Service Segmentation fault or possibly have unspecified other impact...

Apache Jmeter Remote Code Execution Vulnerability

Apache Jmeter is the United States Apache Apache Software Foundation of a set of open source software written in Java language for stress testing and performance testing . A remote code execution vulnerability exists in Apache Jmeter versions 4.0 and 5.0. A remote attacker can exploit this...

PT-2019-6420

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to v4.8 Description The issue is related to out-of-bounds memory accesses in the Linux kernel's netlabel component. There are two array out-of-bounds memory accesses, one in the cipso v4 map lvl valid function, the...

UBUNTU-CVE-2019-3824

A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service...

Vembu StoreGrid Cross-Site Scripting Vulnerability

Vembu StoreGrid is a suite of enterprise-class data backup software from Vembu USA. A cross-site scripting vulnerability exists in several files in Vembu StoreGrid version 4.4.x, which can be exploited by a remote attacker to inject arbitrary Web script or HTML. The files include:...

Pluck Cross-Site Request Forgery Vulnerability (CNVD-2019-05782)

Pluck is a content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in Pluck version 4.7.9-dev1. A remote attacker can exploit this vulnerability to delete articles with /admin.php?action=deletepage&var1= URI...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-05295)

WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. WUZHI CMS version 4.1.0 in the existence of cross-site scripting vulnerability, a remote attacker can / index.php?m=core&f=map&v=baidumap URL 'x' and 'y' parameters to exploit the The...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-05296)

WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. WUZHI CMS version 4.1.0 cross-site scripting vulnerability, remote attackers can use the /index.php?m=attachment&f=imagecut&v=init URL's 'imgurl' parameter to use the vulnerability to inject...

CVE-2019-0259

SAP BusinessObjects, versions 4.2 and 4.3, Visual Difference allows an attacker to upload any file including script files without proper file format validation...

SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2019-04858)

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product has report generation, analysis, data visualization and other functions. A cross-site scripting vulnerability in SAP BusinessObjects Business...

SAP BusinessObjects Business Intelligence Platform Arbitrary File Upload Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product has report generation, analysis, data visualization and other functions. An arbitrary file upload vulnerability exists in SAP BusinessObjects...