Archive
10 September 2019
Vulnerabilities first published on this day (UTC), newest first.
57 results · Feed
-
Unscored —
TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of …
-
Unscored —
TTLock devices do not properly block guest access in certain situations where the network connection to the cloud is un…
-
Unscored —
Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62. This vulnerability could be…
-
Unscored —
HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, …
-
Unscored —
In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potentia…
-
Unscored —
An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.
-
Unscored —
VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header.
-
Unscored —
In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and wri…
-
Unscored —
In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XD…
-
Unscored —
In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index…
-
Unscored —
In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server us…
-
Unscored —
In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that d…
-
Unscored —
ECDSA remote timing attack
Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is p…
-
Unscored —
Fork Protection
OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection w…
-
Unscored —
Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA…
-
Unscored —
An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block comma…
-
Unscored —
The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating…
-
Unscored —
Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-…
-
Unscored —
Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions …
-
Unscored —
In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer resp…
-
Unscored —
SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before vers…
-
Unscored —
Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1…
-
Unscored —
Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1…
-
Unscored —
SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) d…
-
Unscored —
SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and…
-
Unscored —
Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacke…
-
Unscored —
In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp)…
-
Unscored —
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arb…
-
Unscored —
OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which coul…
-
Unscored —
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the …
-
Unscored —CVE-2019-15896 Public exploit
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.l…
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove …
-
High 7.5CVE-2019-12401 Public exploit
Apache Solr vulnerable to XML Bomb
Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will ex…