Information Disclosure Issue in Verodin Director version 3.5.3.1 and earlier

Overview :
This advisory addresses a Information Disclosure vulnerability in Verodin Director affecting version 3.5.3.1 and earlier where an attacker can reveal usernames and passwords of integrated security technologies via a /integrations.json JSON REST API request.
Affected Product(s) :
  • Verodin Director version 3.5.3.1 and earlier
Vulnerability Details :
CVE ID : CVE-2019-10716
An attacker must have an existing authenticated connection to the Director (web interface) of Verodin and make a HTTP GET request to the /integrations.json JSON REST API endpoint.

Disclosure of usernames and passwords that integrations use to contact the security technologies.

Solution :
This vulnerability is mitigated by the requirement that the attacker must be authenticated with the Verodin Director (web interface).

Common Vulnerabilityies and Exposures

Internet Download Manager 6.37.11.1 Export/Import stack-based overflow

A vulnerability, which was classified as critical, was found in Internet Download Manager 6.37.11.1. This affects an unknown code block of the component Export/Import. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Passcovery ZIP Password Recovery 3.70.69.0 Decompression buffer overflow

A vulnerability classified as critical was found in Passcovery ZIP Password Recovery 3.70.69.0. Affected by this vulnerability is an unknown part of the component Decompression. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Portable Playable 9.18 JPEG File filename unrestricted upload

A vulnerability, which was classified as critical, has been found in Portable Playable 9.18. Affected by this issue is an unknown code of the component JPEG File Handler. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.