A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. CVSSv3.1 9.8 (CRITICAL) · EPSS 91th percentile
A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper management of system memory. An attacker could exploit this vulnerability by sending malicious IKEv1 traffic to an affected devic CVSSv3.1 8.6 (HIGH) · EPSS 78th percentile
Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. These vulnerabilities are due to insufficient protections on the underlying filesystem. An attacker could exploit these vulnerabilities by modifying critical files on the underlying filesystem. A successful exploit coul CVSSv3.1 8.8 (HIGH) · EPSS 33th percentile
Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. These vulnerabilities are due to insufficient protections on the underlying filesystem. An attacker could exploit these vulnerabilities by modifying critical files on the underlying filesystem. A successful exploit coul CVSSv3.1 8.2 (HIGH) · EPSS 35th percentile
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling. CVSSv3.1 9.8 (CRITICAL) · EPSS 92th percentile
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSo CVSSv3.1 9.8 (CRITICAL) · EPSS 93th percentile
Impacket 0.9.20 released with Python 3.6 support and significant offensive capabilities including POC code for CVE-2019-1019 (SMB signing bypass) and CVE-2019-1040 (NTLM relay attacks). New tools added for Kerberos interception and S4U2Self exploitation with unkeyed checksums, plus WebDAV-based NTLM relay techniques.
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540. CVSSv3.1 9.8 (CRITICAL) · EPSS 92th percentile
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. CVSSv3.1 9.8 (CRITICAL) · EPSS 96th percentile
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. CVSSv3.1 7.3 (HIGH) · EPSS 98th percentile
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability. CVSSv3.1 9.8 (CRITICAL)
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web portal framework. An attacker could exploit this vulnerability by providing malicious input during web portal authentication. A successful exploit could allow the attacker to execute CVSSv3.1 9.8 (CRITICAL) · EPSS 88th percentile
A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an insufficient authentication mechanism used to establish a VNC session. An attacker could exploit this vulnerability by intercepting an administrator VNC session request prior to login. CVSSv3.1 9.8 (CRITICAL) · EPSS 82th percentile
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions. CVSSv3.1 6.1 (MEDIUM) · EPSS 96th percentile
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications CVSSv3.1 8.8 (HIGH) · EPSS 95th percentile
An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall_reply. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile
An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_reply. CVSSv3.1 9.8 (CRITICAL) · EPSS 63th percentile
An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_reply. CVSSv3.1 9.8 (CRITICAL) · EPSS 63th percentile
An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_reply. CVSSv3.1 9.8 (CRITICAL) · EPSS 63th percentile
An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_reply. CVSSv3.1 9.8 (CRITICAL) · EPSS 63th percentile
An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an *udp_packet_handler call. CVSSv3.1 9.8 (CRITICAL) · EPSS 68th percentile
An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv3 case. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile
An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at nfs_read_reply. CVSSv3.1 9.1 (CRITICAL) · EPSS 66th percentile