CVE-2019-14402: Undefined Security Weakness

cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp SEC-481...

CVE-2019-14391: Undefined Security Weakness

cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs SEC-514...

The vulnerability of the Java VM component of the Oracle Database Server management system allows a hacker to gain access to modify, add, or delete data, or to cause service failures.

The vulnerability of the Java VM component of the Oracle Database Server management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain access to modify, add, or delete data, or cause service interruptions...

CVE-2019-1020015: Undefined Security Weakness

graphql-engine aka Hasura GraphQL Engine before 1.0.0-beta.3 mishandles the audience check while verifying JWT...

Jisiwei i3 robot vacuum cleaner encryption issue vulnerability

Jisiwei i3 is a vacuuming robot from the Chinese company Jisiwei. A vulnerability with encryption issues exists in version 2.0 of the Jisiwei i3 robot vacuum cleaner APP. The vulnerability stems from a networked system or product that does not properly utilize relevant cryptographic algorithms,...

CVE-2019-9849: Undefined Security Weakness

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed...

The vulnerability of the Jenkins Pipeline Remote Loader plugin, related to defects in the data protection mechanism, allows attackers to circumvent sandbox restrictions.

The vulnerability of the Jenkins Pipeline Remote Loader plugin is related to deficiencies in data protection mechanisms. Exploiting this vulnerability allows a malicious actor to bypass sandbox restrictions and execute arbitrary methods remotely...

The vulnerability of Cisco Email Security Appliance’s security systems, which stems from insufficient validation of input data, allows attackers to bypass the configured content filters and compromise the integrity of the protected information.

The vulnerability of Cisco Email Security Appliance’s security systems exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass the configured content filters and compromise the integrity of the protected information...

The vulnerability of the REST API implementation of the Cisco Application Policy Infrastructure Controller, which allows a hacker to elevate their privileges to the root level.

The vulnerability of the REST API implementation of the Cisco Application Policy Infrastructure Controller relates to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to root level by downloading maliciou...

Researcher Bypasses Instagram 2FA to Hack Any Account

A researcher earned a $30,000 bug bounty from Facebook after discovering a weakness in the Instagram mobile recovery process that would allow account takeover for any user, via mass brute-force campaigns. Independent researcher Laxman Muthiyah took a look at Instagram’s mobile recovery flow, whic...

DEBIAN-CVE-2019-1010317

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig caff.c:486. The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit...

GHSA-H595-8PW6-5Q6V Inadequate Encryption Strength in DotNetNuke

DNN aka DotNetNuke 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters...

The vulnerability of the installation mechanism for the software set for developing Intel Data Center Manager SDK allows unauthorized access, enabling attackers to enhance their privileges.

The vulnerability of the installation mechanism for the software development tools for Intel Data Center Manager SDK is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to enhance their privileges...

CVE-2018-15811

DNN aka DotNetNuke 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters...

Nortek Security & Control Linear eMerge E3-Series Cross-Site Request Forgery Vulnerability

The Nortek Security & Control Linear eMerge E3-Series is an access control system from Nortek Security & Control, USA. A cross-site request forgery vulnerability exists in the Nortek Security & Control Linear eMerge E3-Series, which arises from a WEB application that does not adequately validate...

CVE-2018-15812

DNN aka DotNetNuke 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

CVE-2018-15811

DNN aka DotNetNuke 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

CVE-2017-9327: Undefined Security Weakness

Secret data of processes managed by CM is not secured by file permissions...

Weak password vulnerability in Qiji O&M system software

Qiji Technology is a product-based company founded by O&M management experts and focused on O&M operations. Qiji operation and maintenance management system software has a weak password vulnerability, which can be exploited to obtain information about the backend server and manage the bastion...

CVE-2019-4234

CVE-2019-4234 affects IBM PureApplication System versions 2.2.3.0–2.2.5.3. The issue is a weakness in the locking feature implementation in the pattern editor, allowing an attacker who intercepts subsequent requests to bypass business logic and modify a pattern to an unlocked state. The NVD entry...