PT-2020-14922 · Readytalk · Readytalk Avian

Name of the Vulnerable Software and Affected Versions: ReadyTalk Avian version 1.2.0 Description: An issue was discovered in the vm::arrayCopy method defined in classpath-common.h, which contains multiple boundary checks to prevent out-of-bounds memory read/write. However, two of these boundary...

PT-2020-14702 · Bsdiff4 · Bsdiff4

Name of the Vulnerable Software and Affected Versions: bsdiff4 versions prior to 1.2.0 Description: A buffer overflow in the patching routine allows an attacker to write to heap memory beyond allocated bounds via a crafted patch file. Recommendations: For versions prior to 1.2.0, update to versio...

O2 Business for Android Input Validation Error Vulnerability

O2 Business for Android is an Android-based application for connecting O2 Business solutions from O2 UK. A security vulnerability exists in version 1.2.0 of O2 Business for Android-based platforms, which stems from the program exposing the canvasm.myo2.SplashActivity activity to other application...

Mattermost Server Resource Management Error Vulnerability (CNVD-2020-35451)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 1.2.0. An attacker can exploit this vulnerability to cause a denial of service with a small compressed file...

CVE-2020-7351 Fonality Trixbox CE Post-Authentication Command Injection

An OS Command Injection vulnerability in the endpointdevicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012...

Information disclosure

The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties...

CVE-2020-12118

The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties...

PT-2020-15357 · Jenkins · Jenkins Mabl Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mac Plugin versions 1.1.0 and earlier Description: The issue concerns the lack of SSH host key validation when connecting agents created by the plugin, which could enable man-in-the-middle attacks. This allows an attacker to intercept...

PT-2020-15326 · Jenkins · Jenkins Azure Ad Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Azure AD Plugin versions 1.1.2 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. Specificall...

CVE-2020-1940

The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does n...

Design/Logic Flaw

Halo before 1.2.0-beta.1 allows Server Side Template Injection SSTI because TemplateClassResolver.SAFERRESOLVER is not used in the FreeMarker configuration...

CVE-2019-19999

Halo before 1.2.0-beta.1 allows Server Side Template Injection SSTI because TemplateClassResolver.SAFERRESOLVER is not used in the FreeMarker configuration...

Halo Code Issue Vulnerability

Halo is a personal blogging system. A security vulnerability exists in Halo versions prior to 1.2.0-beta.1. An attacker can exploit the vulnerability to execute commands...

Apache Atlas XSS Vulnerability (Nov 2019)

Apache Atlas is prone to a stored cross-site scripting XSS vulnerability in the search functionality. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Eclipse Paho Java client library input validation error vulnerability

Eclipse Paho Java client library is the Eclipse Foundation of a use of the Java language written in MQTT Message Queuing Telemetry Transport client library . An input validation error vulnerability exists in the Eclipse Paho Java client library version 1.2.0. The vulnerability originates from a...

Joomla Cactus 1.2.0 SQL Injection

Exploit Title : Joomla 1.5.15 Cactus 1.2.0 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/10/2019 Vendor Homepage : anatoliasystems.com Joomla Affected Versions : 1.5.4 and 1.5.15 Software Affected Version : 1.2.0...

CVE-2019-11211

The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an authenticated user to trigger remote code execution in certain circumstances. When the...

Apache Ranger Cross-Site Request Forgery Vulnerability

Apache Ranger is a set of architectures from the Apache USA Software Foundation that implement comprehensive security measures for Hadoop clusters. The product provides centralized security policy management for core enterprise security requirements such as authorization, billing and data...

PT-2019-11780 · Jenkins · Jenkins Xl Testview Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins XL TestView Plugin versions 1.2.0 and earlier Description: A cross-site request forgery issue allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturin...

Jolokia Cross-Site Request Forgery Vulnerability (CNVD-2019-26164)

Jolokia is a use of JSON via Http to achieve JMX remote management of open source projects , it provides JMX batch operation , security policies and so on. A cross-site request forgery vulnerability exists in Jolokia versions 1.2.0 through 1.6.0. The vulnerability stems from a WEB application tha...