The vulnerability of the WLS Core Components of the Oracle WebLogic Server application server allows a hacker to gain full control over the application.

The vulnerability of the WLS Core Components component of the Oracle WebLogic Server application server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application, using the T3 network protocol...

Apache Tomcat 7.0.0 < 7.0.85 Security Constraint Weakness

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.85. It is, therefore, affected by a security constraints flaw which could expose resources to unauthorized users. Note that the scanner has not tested for these issues but has instead relied only on the application's...

Apache Tomcat 9.0.0.M1 < 9.0.5 Security Constraint Weakness

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.5. It is, therefore, affected by security constraints flaws which could expose resources to unauthorized users. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WordPress 4.7.x < 4.7.7 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. - When domain-based...

Apache Tomcat 7.0.79 < 7.0.84 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.84. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 8.5.x < 8.5.28 Security Constraint Weakness

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.28. It is, therefore, affected by security constraints flaws which could expose resources to unauthorized users. Note that the scanner has not tested for these issues but has instead relied only on the application's...

The vulnerability in the FortiOS operating system’s web interface allows a hacker to inject any desired JavaScript or HTML code.

The vulnerability in the user interface of the FortiOS operating system arises from insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript or HTML code using the “redirect” parameter...

CVE-2016-2121

A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A local, unprivileged user could possibly use this flaw to access unauthorized system information...

RHEL 7 : jasper (RHSA-2018:3253)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3253 advisory. - jasper: reachable assertion in JPCNOMINALGAIN CVE-2016-9396 - jasper: NULL pointer exception in jp2encode CVE-2017-1000050 Note that Nessu...

samba: Weak authentication protocol regression

A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client...

OrientDB Server Community Edition uses insufficiently random values to generate session IDs

OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values in the server/network/protocol/http/OHttpSessionManager.java, which makes it easier for remote attackers to predict a value by...

NUUO CMS Code Execution Vulnerability (CNVD-2018-21168)

NUUO CMS is a set of centralized software management platform from NUUO. The platform is used to centrally manage devices such as NVRs hard disk recorders and IP cameras, and provides functions such as user management and alarm management. A security vulnerability exists in NUUO CMS 3.1 and earli...

VMware Workstation SVGA Heap-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the guest system in order to exploit this vulnerability. The specific flaw exists within the handling ...

The vulnerability of the encryption module for internal data in Philips e-Alert Unit software solutions allows a intruder to gain full access to the device’s data.

The vulnerability of the encryption module for internal data in Philips e-Alert Unit medical visualization systems arises from the rigid encoding of the cryptographic key used for encrypting internal data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full...

The vulnerability of microprogrammed software in Schneider Electric Modicon M221 programmable logic controllers arises from deficiencies in the authentication process, which allows attackers to bypass the authentication procedures.

The vulnerability of the microprogrammed software in Schneider Electric Modicon M221 programmable logic controllers is due to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to bypass the authentication process remotely...

The vulnerability of microprogrammed software in Schneider Electric Modicon M221 programmable logic controllers is caused by deficiencies in the authentication process, allowing attackers to re-enter passwords.

The vulnerability of the microprogrammed software in Schneider Electric Modicon M221 programmable logic controllers is due to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to remotely reassign passwords...

chromium-browser: Script injection in New Tab Page

Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

CVE-2018-10936

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by...

ICSMA-18-240-01_Qualcomm Life Capsule

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Qualcomm Life Equipment: Capsule Datacaptor Terminal Server DTS Vulnerability: Code Weakness 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute...

The vulnerability of the microprogramming software of the 4G LTE Light Industrial M2M Router (NWL-25) arises from the lack of measures taken to protect the website structure. This allows attackers to execute arbitrary JavaScript code in the user’s browser.

The vulnerability of the microprogrammed software of the 4G LTE Light Industrial M2M Router NWL-25 is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser remotely...