CVE-2019-14251

CVE-2019-14251 (TEMENOS TEMENOS Channels R15.01, T24 Web Server): A local file inclusion (LFI) vulnerability exists in the T24 TEMENOS Channels web interface. Unauthenticated attackers can abuse the downloadDocServer() function (via WealthT24/GetImage with docDownloadPath/uploadLocation) to trave...

CVE-2018-7282

The CVE-2018-7282 issue affects TITool PrintMonitor. The Nuclei template confirms a vulnerability in the username parameter during login, enabling time-based blind SQL injection. Impact: unauthenticated attackers could extract database contents and potentially access sensitive printing data. Reme...

CVE-2019-5544

CVE-2019-5544 refers to a heap-based buffer overflow in OpenSLP used by VMware ESXi and Horizon DaaS, triggered by processing URLs in service requests to port 427. The root cause is improper bounds checking in the OpenSLP slpd service (ProcessSrvRqst), enabling remote code execution via a crafted...

CVE-2019-17387

Aviatrix VPN Client AVPNC_RP service (versions up to 2.2.10) contains an authentication flaw that allows local attackers to execute arbitrary code and escalate privileges on Windows, Linux, and macOS. The vulnerability is described as a local privilege escalation via an authentication weakness, w...

CVE-2019-7195

CVE-2019-7195 is a QNAP Photo Station external file name/path control vulnerability. The CVE affects QNAP Photo Station on QTS with Photo Station versions prior to the fixes listed in QNAP NAS advisory NAS-201911-25 and related vendor advisories. The underlying issue is a path traversal/ improper...

CVE-2019-7194

CVE-2019-7194 is a QNAP Photo Station path-traversal vulnerability (external control of file name/path) that allows remote access to or modification of files. Affected: QNAP Photo Station (versions 5.2.11, 5.4.9, 5.7.10, and 6.0.3 or earlier). Impact per sources: remote access/modification of sys...

CVE-2019-7193

CVE-2019-7193 affects QNAP QTS 4.3.6 and 4.4.1 (and earlier) where an improper input validation allows remote attackers to inject arbitrary code. This is documented to enable remote code execution on affected devices. Mitigation provided: update QTS to versions listed by QNAP as 4.4.1 build 20190...

CVE-2019-7192

CVE-2019-7192 affects QNAP Photo Station on QTS. The vulnerability is an improper access control that enables remote attackers to gain unauthorized system access (pre-auth RCE). Public write‑ups and advisories discuss unvalidated access to Photo Station components, with several CVEs in the same f...

CVE-2019-19492

CVE-2019-19492 affects FreeSWITCH versions 1.6.10–1.10.1 due to a default password in the event_socket.conf.xml. The underlying issue is the presence of a default credential in the event_socket component, which could allow unauthorized access if the default credentials are not changed. The connec...

CVE-2019-15271

Cisco CVE-2019-15271 affects Small Business RV Series routers (RV016, RV042, RV042G, RV082). The issue is due to insufficient input validation of the HTTP payload in the web-based management interface, allowing an authenticated remote attacker with valid credentials or an active session token to ...

CVE-2011-3600

CVE-2011-3600 affects Apache OFBiz: the /webtools/control/xmlrpc endpoint in the OFBiz XML-RPC handler is vulnerable to External Entity Injection through DOCTYPE declarations, enabling disclosure of filesystem contents and allowing port probe and existence checks via error messages. Affected vers...

CVE-2019-5825

CVE-2019-5825 is a Google Chrome vulnerability in the V8 JavaScript engine: an out-of-bounds write that can enable remote heap corruption via a crafted HTML page. Affected software is Chrome (prior to 73.0.3683.86); the issue is tied to JavaScript execution/v8, leading to potential stability or m...

CVE-2019-13720

CVE-2019-13720 is a use-after-free in Chrome’s WebAudio (Chromium) prior to 78.0.3904.87 that could allow remote code execution via a crafted HTML page, with heap corruption as the underlying risk. Public documents identify the affected component as the WebAudio functionality in Chrome/Chromium a...

CVE-2014-8356

The CVE-2014-8356 issue affects Zhone zNID GPON 2426A and related 24xx/42xx/26xx/28xx-series devices, with firmware older than S3.0.501. The vulnerability arises from an Insecure Direct Object Reference that allows remote authenticated users to bypass access controls by altering server responses ...

CVE-2019-19006

CVE-2019-19006 affects Sangoma FreePBX; multiple releases are vulnerable due to incorrect access control. Affected versions: FreePBX 13.x prior to 13.0.197.14, 14.x prior to 14.0.13.12, and 15.x prior to 15.0.16.27. The vulnerability enables remote authentication bypass on the admin interface (re...

CVE-2019-6693

Fortinet FortiOS contains a vulnerability CVE-2019-6693: use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup files. An attacker with access to the backup file could decrypt sensitive data, including users’ passwords (excluding admin), private keys’ passp...

CVE-2019-18952

CVE-2019-18952 affects SibSoft Xfilesharing up to version 2.5.1, enabling an arbitrary file upload through cgi-bin/up.cgi. The accompanying data shows this can be chained with CVE-2019-18951 (directory traversal via op=page&tmpl=…) to achieve remote code execution, using a crafted HTML file serve...

CVE-2019-18951

CVE-2019-18951 affects SibSoft Xfilesharing up to version 2.5.1. The vulnerability is a directory traversal via op=page&tmpl=../, allowing reading arbitrary files. Public sources in the connected documents corroborate a path traversal/LFI-style exposure, with exploit context and mention of a comb...

CVE-2019-1428

Technical details for CVE-2019-1428 are not publicly provided in the connected documents. The available materials confirm Edge memory corruption in HTML-based scripting engine but do not specify affected versions, exploit vectors, or fixes. Monitor for vendor advisories.

CVE-2019-1429

CVE-2019-1429 is a Microsoft Internet Explorer JScript memory-corruption vulnerability (use-after-free) in the scripting engine. It fixes a shortcoming/variant of CVE-2019-1367, specifically triggered via toJSON in the arguments array, with exploitation in-the-wild noted and a patch released by M...