CVE-2019-5123

Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php...

CVE-2019-5123

The CVE-2019-5123 issue affects YouPHPTube 7.6 and involves SQL injection via the /objects/pluginSwitch.json.php endpoint (parameter dir). The TALOS advisory confirms authenticated SQL injections in the YouPHPTube 7.6 frontend/plugin switch logic, potentially allowing exfiltration of database dat...

CVE-2019-5122

SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.json.php...

CVE-2019-5117

Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

PT-2019-15271 · Wago · Wago Series Pfc200 +1

Name of the Vulnerable Software and Affected Versions: WAGO Series PFC100 and PFC200 devices versions prior to FW12 Description: The issue allows for Information Disclosure due to improper access control. A remote attacker can exploit this by sending crafted HTTP requests to check for the existen...

YouPHPTube /objects/commentAddNew.json.php comments_id SQL injection vulnerability

Summary An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowin...

CVE-2019-14656

Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account with a password of user can make admin requests via HTTP...

Microsoft Office SharePoint XSS Vulnerability

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

Microsoft IIS Server Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT...

CVE-2019-11651

Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web reques...

Cross site scripting

Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web reques...

VulnCheck KEV: CVE-2018-13379

Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests...

ACTi ACM-5611 Camera Remote Command Execution Vulnerability

The ACTi ACM-5611 is a network camera manufactured by ACTI. A remote command execution vulnerability exists in the ACTi ACM-5611 Camera. The vulnerability stems from the program not properly validating user-submitted data. A remote attacker can exploit this vulnerability by sending a malicious HT...

The vulnerability of the Security component of the MICROS Lucas software, which allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Security component of the MICROS Lucas software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to influence the confidentiality, integrity, and accessibility of the protected information through HTTP requests...

The vulnerability of the Segment component in Oracle Retail Customer Engagement software allows a hacker to gain read access to data or cause a partial service disruption.

The vulnerability of the Segment component in Oracle Retail Customer Engagement software relates to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain read-only access to data or cause partial service disruption by sending specially crafted HTTP requests...

The vulnerability of the Back Office component of the MICROS Retail-J software allows a hacker to disclose protected information.

The vulnerability of the Back Office component of the MICROS Retail-J software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose sensitive information through HTTP requests...

The vulnerability of the RouterOS operating system in MikroTik routers allows a hacker to cause a service failure.

The vulnerability of the RouterOS operating system for MikroTik routers is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by sending specially crafted HTTP requests...

Security Update for .NET Core SDK (Sep 2019)

The Microsoft .NET Core SDK installation on the remote host is version 2.1.x 2.1.509, or 2.1.606 or 2.1.802, 2.2.x 2.2.109 or 2.2.206 or 2.2.302. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability when .Net Core improperly handles web requests. An...

dotnet: System.Net.Sockets.dll Socket.ConnectAsync Denial of Service

A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'...

dotnet: System.Net.Sockets.dll Socket.ConnectAsync Denial of Service

A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'...