CVE-2019-1129

CVE-2019-1129 is a Windows AppX Deployment Service (AppXSVC) privilege-escalation vulnerability caused by improper handling of hard links. The issue enables local Privilege Escalation with high impact; CVSS 3.1 base score 7.8 (LOCAL, LOW complexity, no user interaction) as documented by NVD, and ...

CVE-2019-13382

The CVE describes a local privilege escalation in SnagIT. UploaderService in SnagIT 2019.1.2 allows an attacker to elevate privileges by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmith Recorder\QueuedPresentations and then creating a symbolic link in %PROGRAMDATA%\Techsm...

CVE-2019-2768

CVE-2019-2768 affects Oracle Fusion Middleware BI Publisher (XML Publisher) Security, specifically the BI Publisher component, in version 11.1.1.9.0. The vulnerability allows an unauthenticated, network-based attacker to access BI Publisher data via HTTP, potentially leading to unauthorized acces...

CVE-2019-11707

CVE-2019-11707 is a type confusion vulnerability in Mozilla Firefox/Thunderbird caused by issues in Array.pop when manipulating JavaScript objects, leading to an exploitable crash. It affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird

CVE-2019-11708

CVE-2019-11708 is a sandbox-escape vulnerability in Mozilla Firefox ESR and Thunderbird caused by insufficient vetting of parameters in the Prompt:Open IPC message between child and parent processes, allowing a compromised child to cause the non-sandboxed parent to open web content and potentiall...

CVE-2019-12725

Zeroshell 3.9.0 is affected by a remote command execution vulnerability in the web application, caused by mishandling of HTTP parameters, allowing unauthenticated attackers to inject and execute arbitrary OS commands. The issue primarily affects the web interface (e.g., the vulnerable parameter h...

CVE-2019-1579

CVE-2019-1579 is a Remote Code Execution in PAN-OS when GlobalProtect Portal or Gateway Interface is enabled. It affects PAN-OS 7.1.x before 7.1.19, 8.0.x before 8.0.12, and 8.1.x before 8.1.3, allowing an unauthenticated attacker to execute arbitrary code. The flaw’s root cause is an issue in th...

CVE-2019-13272

CVE-2019-13272 affects the Linux kernel ptrace code (kernel/ptrace.c), where credentials recording during ptrace relationship establishment can fail, enabling a local attacker to obtain root privileges under certain parent/child lifecycle scenarios and potentially cause a panic. Public advisories...

CVE-2019-12985

CVE-2019-12985 affects Citrix SD-WAN Center (10.2.x before 10.2.3) and NetScaler SD-WAN Center (10.0.x before 10.0.8). The connected Nuclei template details a remote command injection vulnerability in the DiagnosticsController ping function, caused by insufficient validation/sanitization of HTTP ...

CVE-2019-12986

Citrix SD-WAN Center/NetScaler SD-WAN Center are affected by CVE-2019-12986 through an unauthenticated remote command injection in the trace_route function of DiagnosticsController. The issue arises from insufficient validation/sanitation of HTTP request parameters used to construct shell command...

CVE-2019-12987

Citrix SD-WAN Center / NetScaler SD-WAN Center are affected by CVE-2019-12987 due to improper input validation in the StorageMgmtController’s apply action, where the callStoragePerl helper constructs shell commands from HTTP parameters. An attacker can route traffic through the Collector controll...

CVE-2019-12989

CVE-2019-12989 affects Citrix SD-WAN 10.2.x prior to 10.2.3 and NetScaler SD-WAN 10.0.x prior to 10.0.8. An unauthenticated attacker can exploit an SQL injection caused by improper input validation in specific components, potentially leading to arbitrary SQL execution against the backend database...

CVE-2019-12990

CVE-2019-12990 refers to a Local File Inclusion/vulnerability in Citrix SD-WAN Center and NetScaler SD-WAN Center. The Nuclei template and CNVD/Red Hat/ CIRCL entries describe an issue where the applianceSettingsFileTransfer function in ApplianceSettingsController fails to properly validate HTTP ...

CVE-2019-12991

CVE-2019-12991 affects Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance: authenticated command injection in 10.2.x before 10.2.3 and 10.0.x before 10.0.8. Connected advisories confirm a remote command execution vector via the appliance’s management/UI stack and public exploits exist (e.g., ...

CVE-2019-1068

CVE-2019-1068 is a remote code execution vulnerability in Microsoft SQL Server caused by a stack overflow in the svl.dll component during processing of internal functions. An authenticated attacker (low privileges) can trigger it remotely via a specially crafted SQL query , gaining code execution...

CVE-2019-0880

CVE-2019-0880 is a local privilege-escalation in Windows where splwow64.exe mishandles certain calls, allowing a low-privilege user to elevate to medium integrity. Public details in the Initial and connected documents confirm the vulnerability class and affected component, and Microsoft’s MSRC en...

CVE-2019-13396

FlightPath is affected by CVE-2019-13396: versions prior to 4.8.2 and 5.0-rc2 contain a Local File Inclusion vulnerability caused by include_once in system_handle_form_submit, enabling directory traversal via the form_include parameter in index.php?q=system-handle-form-submit. Impact cited includ...

CVE-2019-13372

D-Link Central WiFi Manager CWM(100) is affected by a remote code execution vulnerability in /web/Lib/Action/IndexAction.class.php. Before v1.03R0100_BETA6, a crafted cookie can trigger eval injection via the cookie’s username field, and an empty password bypasses authentication, enabling unauthe...

CVE-2017-8226

Technical details about CVE-2017-8226 are not publicly provided in the supplied documents. The materials mention default credentials and vulnerable firmware but do not disclose affected components, versions, or remediation specifics. Monitor for updates.

CVE-2018-18325

Summary: CVE-2018-18325 affects DNN (DotNetNuke) platforms running version 9.2 through 9.2.2. The issue is an inadequate encryption strength for input parameters, arising from an incomplete fix for CVE-2018-15811. The vulnerability is tied to the use of a weak encryption algorithm in protecting i...