8764 matches found
GHSA-Q4HG-RMQ2-52Q9 Improper Locking in Apache Tomcat
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOWUPDATE messages for the connection window stream 0 clients were able to cause server-side threads to...
pfSense cross-site scripting vulnerability (CNVD-2019-19311)
pfSense is a set of network firewalls based on FreeBSD Linux. A cross-site scripting vulnerability exists in pfSense versions 2.4.4-p2 and 2.4.4-p3. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to execu...
SUSE-SU-2019:1607-1 Security update for wireshark
This update for wireshark to version 2.4.15 fixes the following issues: Security issue fixed: - Fixed a denial of service in the dissection engine bsc1136021...
PT-2019-11674 · WordPress · Ultimate Member
Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin version 2.39 for WordPress Description: An issue was discovered in the password reset functionality, allowing an attacker to reset the password of another user without proper verification. This is possible because the...
TP-Link TL-WR1043ND Encryption Issue Vulnerability
The TP-Link TL-WR1043ND is a wireless router from China P&L TP-Link. An encryption issue vulnerability exists in the TP-Link TL-WR1043ND V2. The vulnerability stems from a network system or product that does not properly use the relevant cryptographic algorithms, and can be exploited by an attack...
RedwoodHQ Bypass Authentication Vulnerability
RedwoodHQ is an open source automated testing framework. The product supports programming languages such as Java, Groovy, Python and C and is capable of creating readable keyword-driven test cases. A security vulnerability exists in RedwoodHQ version 2.5.5. The vulnerability stems from a lack of...
Helpy Cross-Site Scripting Vulnerability
Helpy is an open source customer support application. The program includes features such as a knowledge base, community discussions and email. A cross-site scripting vulnerability exists in Helpy version 2.1.0. The vulnerability stems from the WEB application lacking proper validation of...
curl: NTLM type-2 heap out-of-bounds buffer read
An out-of-bounds read flaw was found in the way curl handled NTLMv2 type-2 headers. When connecting to a remote malicious server which uses NTLM authentication, the flaw could cause curl to crash...
MISP Remote Command Execution Vulnerability
MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A code issue vulnerability exists in MISP version 2.4.109. A remote attacker could exploit...
Optergy Proton/Enterprise Arbitrary Code Execution Vulnerability (CNVD-2019-24770)
Optergy Proton/Enterprise is an enterprise building management system from Optergy USA. An arbitrary code execution vulnerability exists in Optergy Proton/Enterprise versions 2.3.0a and earlier. The vulnerability stems from an improper design or implementation during code development of a network...
PT-2019-2638 · Jenkins · Jenkins Token Macro Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Token Macro Plugin versions 2.7 and earlier Description: The issue is related to an XML external entities XXE vulnerability. It allows attackers who can control the content of the input file for the "XML" macro to have Jenkins resolve...
PHP Scripts Mall Investment MLM Software Cross-Site Scripting Vulnerability
PHP Scripts Mall Investment MLM Software is an investment money management system software from PHP Scripts Mall India. A cross-site scripting vulnerability exists in the My Profile Section of PHP Scripts Mall Investment MLM Software version 2.0.2, which can be exploited by an attacker to execute...
Joruri Mail Input Validation Error Vulnerability
Joruri Mail is a set of IMAP e-mail client software written using Ruby/Rails . An input validation error vulnerability exists in Joruri Mail 2.1.4 and prior versions, which arises from a network system or product that does not properly validate incoming data and can be exploited by a remote...
The vulnerability of the SSLv2 protocol implementation in the Network Security Services library allows attackers to disclose protected information.
The vulnerability of the SSLv2 protocol implementation in the Network Security Services library is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...
eZ Platform Admin UI Cross-Site Scripting Vulnerability
eZ Platform is an open source enterprise content management system CMS. admin UI is one of the back-end management interface . A cross-site scripting vulnerability exists in the Admin UI in eZ Platform version 2.x, which can be exploited by an attacker to execute client-side code...
CVE-2019-0301
Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2, which would otherwise be restricted only for viewing...
TPshopv2.0.0 open source mall system command execution vulnerability
Ltd. is a professional research and development of e-commerce software as the main business of the group of companies, set sales, marketing, product development, technical support, product implementation, after-sales service and many other functions in one of the professional enterprise managemen...
CVE-2019-6613
On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types and is accessed using SNMPv2...
PT-2019-18201 · F5 · F5 Big-Ip
Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 12.1.0 through 12.1.4 F5 BIG-IP versions 13.0.0 through 13.1.1.4 F5 BIG-IP versions 14.0.0 through 14.1.0.1 Description: The Traffic Management Microkernel TMM may restart when a virtual server has an HTTP/2 profile with...