@alexbp-ds/microservice-wrapper (1.1.8), @apifie/node-microservice (>=0.0.1, <=1.0.3) +81 more potentially affected by CVE-2019-16777 via npm (>=6.0.0, <=6.13.2)

npm NPM version =6.0.0, =0.0.1, =0.1.2, =0.4.3, =1.0.0-beta.0, =1.0.0-beta.15, =1.1.58, =3.2.2, =2.0.0, =0.0.1, =3.0.0, =4.0.0, =4.0.1 and more Source cves: CVE-2019-16777 Source advisory: OSV:GHSA-4328-8HGF-7WJR...

Juniper JSA10960

The version of Junos OS installed on the remote host is prior to 15.1X49-D171, 15.1X53-D496, 16.1R7-S4, 16.2R2-S9, 17.1R3, 17.2R1-S8, 17.3R3-S4, 17.4R1-S6, 18.1R2-S4, 18.2R1-S5, 18.3R1-S3, or 18.4R1-S2. It is, therefore, affected by a vulnerability as referenced in the JSA10960 advisory. Note tha...

CVE-2019-18333

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could gain access to filenames on the server by sending specifically crafted packets to 8090/tcp. Please note that an attacker needs t...

Vulnerability Spotlight: AMD ATI Radeon ATIDXX64.DLL shader functionality sincos denial-of-service vulnerability

Piotr Bania of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered a denial-of-service vulnerability in a specific dll inside of the AMD ATI Radeon line of video cards. This vulnerability can be triggered by supplying a malformed pixel shader inside a...

Slack: Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookies

Hi Slack Security Team! My name is Evan and I'm a first time bug hunter to your platform : Because you guys were running a month long bounty promotion I decided to take a little of my time and gently perform recon on your platform. Specifically the area of interest I focus in is HTTP Request...

Code execution vulnerability in SeaCMS backend (CNVD-2019-45349)

SeaCMS is a station building system based on PHP+MYSQL architecture and supports cross-platform operation. A code execution vulnerability exists in the background of SeaCMS, which can be exploited by attackers to execute malicious code...

PT-2019-3336 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers ISRs affected versions not specified Description: A vulnerability in the Dialer interface feature for ISDN connections could allow an unauthenticated, adjacent attacker t...

RHEL 7 : glibc (RHSA-2019:2118)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2118 advisory. The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name service cache...

ids-enterprise-ng (>=4.10.0-beta.0, <=5.3.0) potentially affected by unknown CVE via ids-enterprise (>=4.10.0, <=4.18.1)

ids-enterprise NPM version =4.10.0, =4.10.0-beta.0, =5.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-HPFQ-8WX8-CGQW...

ids-enterprise-ng (>=4.10.0-beta.0, <=5.3.0) potentially affected by unknown CVE via ids-enterprise (>=4.10.0, <=4.18.1)

ids-enterprise NPM version =4.10.0, =4.10.0-beta.0, =5.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-CRFX-5PHG-HMW9...

cmd-resume (>=3.0.72, <=3.1.0) potentially affected by unknown CVE via jquery.terminal (1.4.3)

jquery.terminal NPM version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on jquery.terminal and may be impacted: - cmd-resume =3.0.72, =3.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-2HWP-G4G7-MWWJ...

Legrand BTicino Driver Manager F454 1.0.51 - Cross-Site Request Forgery Cross-Site Scripting

Legrand BTicino Driver Manager F454 1.0.51 - Cross-Site Request Forgery Cross-Site Scripting input type="hidden" name="password2" value="newpass123" /...

backender (>=0.0.1, <=0.0.7), gulp-backender (>=0.0.4, <=0.0.5) potentially affected by CVE-2016-10604 via dalek-browser-chrome (0.0.11)

dalek-browser-chrome NPM version 0.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on dalek-browser-chrome and may be impacted: - backender =0.0.1, =0.0.4, =0.0.5 Source cves: CVE-2016-10604 Source advisory: OSV:GHSA-6Q8Q-RVF4-M4PG...

GHSA-4GQ5-CH57-C2MG Arbitrary Code Execution in jackson-databind

FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization...

DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting

DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting Date: 2018-11-22 Exploit Author: Mohammed Abdul Raheem Vendor Homepage: domainmod https://domainmod.org/ Software Link: domainmod https://github.com/domainmod/domainmod Version:...

CyberArk 9.7 - Memory Disclosure

Exploit Title: CyberArk 9.7 - Memory Disclosure Date: 2018-06-04 Exploit Author: Thomas Zuk @Freakazoidile Vendor Homepage: https://www.cyberark.com/products/privileged-account-security-solution/enterprise-password-vault/ Version: 9.7 and 10 Tested on: Windows 2008, Windows 2012, Windows 7, Windo...

Cisco Prime Collaboration Assurance Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF...

@hpcc-js/dgrid-shim (>=0.1.10, <=0.1.12), bryaktestgrid (>=0.0.1, <=0.0.6) +2 more potentially affected by CVE-2018-15494 via dojox (>=1.11.2, <=1.13.0)

dojox NPM version =1.11.2, =0.1.10, =0.0.1, =0.1.0, =0.0.1, =0.5.24 Source cves: CVE-2018-15494 Source advisory: OSV:GHSA-84CM-X2Q5-8225...

192.168.0.172 (4.6.1), 3loc (>=0.2.0, <=0.4.0) +3455 more potentially affected by CVE-2016-1000232 via tough-cookie (>=2.0.0, <=2.2.2)

tough-cookie NPM version =2.0.0, =0.2.0, =0.0.1, =0.0.1, =2.1.0, =0.0.0, =0.1.0-alpha.1, =1.0.1, =0.11.0-atomist-update-branch-master-1541106195325.20181102202646, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =0.2.2-20180615211533, =0.2.4-20180621213746, =0.1.0-20180815155955,...

cucumber-html-reporter-common-functions (>=1.0.24, <=1.0.32), cucumber-report-generator (1.0.3) +10 more potentially affected by CVE-2017-16077 via mongose (0.0.2-security)

mongose NPM version 0.0.2-security is affected by a known vulnerability. The following packages have a transitive dependency on mongose and may be impacted: - cucumber-html-reporter-common-functions =1.0.24, =1.0.0, =1.0.7, =1.0.58, =1.0.12, =1.0.17, =1.1.11 - owltech 1.0.0 - reports-server 1.0.0...