CVE-2020-22552

The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-unit flag set to No and S7 writes a var function, the Snap7 server will be crashed...

CVE-2020-22552

The CVE-2020-22552 issue affects the Snap7 server component, specifically version 1.4.1, where an attacker sending a crafted COTP packet with the last-data-unit flag set to No and triggering a S7 writes a var function can crash the server. The root cause is described in the PT-2020-15480 report, ...

PT-2020-15480

Name of the Vulnerable Software and Affected Versions Snap7 version 1.4.1 Description The issue occurs when an attacker sends a crafted packet using the COTP protocol with the last-data-unit flag set to No, and the S7 function writes a variable. This results in the Snap7 server crashing...

PT-2020-19742 · Npm · Node-Oojs

Name of the Vulnerable Software and Affected Versions: node-oojs versions prior to 1.4.1 Description: The issue concerns Prototype Pollution via the setPath function. This allows for potential manipulation of object properties, which could lead to various security issues. Recommendations: For...

GHSA-F9VC-Q3HH-QHFV Content Injection in remarkable

Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly whitelist link protocols, and consequently allowed javascript: to be used. Proof of Concept Markdown Source: link Rendered HTML: li...

Content Injection in remarkable

Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly whitelist link protocols, and consequently allowed javascript: to be used. Proof of Concept Markdown Source: link Rendered HTML: li...

CVE-2020-11083

In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users...

Impress CMS 1.4.0 Cross Site Scripting

Author: AppleBois Homepage: https://sourceforge.net/projects/impresscms/ Affected Version: 1.4.0 Stored XSS Allows an attacker to execute arbitrary HTML and JavaScript code Solution: Update to 1.4.1 More information : https://github.com/ImpressCMS/impresscms/issues/659 Payload = alert'AppleBois';...

Security Bulletin: Potential vulnerability with FasterXML jackson-databind

Summary A potential vulnerability has been identified related to FasterXML jackson-databind. Refer to details for additional information. Vulnerability Details CVEID: CVE-2020-8840 DESCRIPTION: An unspecified error with the lack of certain xbean-reflect/JNDI blocking in FasterXML jackson-databind...

Security Bulletin: Multiple potential vulnerabilities in Node.js

Summary Node.js is potentially exposed to 2 identified vulnerabilities. Vulnerability Details CVEID: CVE-2019-15605 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attack...

Security Bulletin: Potential vulnerability in Java

Summary A potential vulnerability has been identified related to Java. Refer to details for additional information. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to...

PT-2020-13247 · Hashicorp +1 · Hashicorp Vault +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 1.4.0 through 1.4.1 Description: The issue arises when HashiCorp Vault and Vault Enterprise are configured with the GCP Secrets Engine, potentially leading to the incorrect generation of GCP...

Apple SwiftNIO Extras Denial of Service Vulnerability

Apple SwiftNIO Extras is an extension of the SwiftNIO web application framework from Apple USA. A security vulnerability exists in Apple SwiftNIO Extras versions prior to 1.4.1. A remote attacker could exploit this vulnerability to cause a denial of service in the client or server...

Java-WebSocket Trust Management Issue Vulnerability

Java-WebSocket is a WebSocket client and server implementation written in Java language . A security vulnerability exists in Java-WebSocket 1.4.1 and earlier versions that stems from WebSocketClient failing to validate SSL hostnames. No details of the vulnerability are provided at this time...

CVE-2020-7133

A unauthorized remote access vulnerability was discovered in HPE IOT + GCP versions: 1.4.0, 1.4.1, 1.4.2, 1.2.4.2...

CVE-2020-7134

A remote access to sensitive data vulnerability was discovered in HPE IOT + GCP versions: 1.4.0, 1.4.1, 1.4.2, 1.2.4.2...

CVE-2020-7133

A unauthorized remote access vulnerability was discovered in HPE IOT + GCP versions: 1.4.0, 1.4.1, 1.4.2, 1.2.4.2...

HPESBHF03947 rev.1 - HPE UIoT, Remote Unauthorized Access and Access to Sensitive Data

Potential Security Impact: Remote: Unauthorized Access to Sensitive Information, Unauthorized Data Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE IOT + GCP 1.4.0, 1.4.1, 1.4.2, 1.2.4.2 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2020-7133 ...

Low: Red Hat Security Advisory: AMQ Online security update

An update of the Red Hat OpenShift Container Platform 3.11 and 4.1 container images is now available for Red Hat AMQ Online. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Wyse Management Suite Cross-Site Scripting Vulnerability (CNVD-2020-17378)

Wyse Management Suite WMS is a scalable solution for managing and optimizing Wyse endpoints from Dell, USA. The product includes centralized management of Wyse endpoints, asset tracking and automated device discovery. A cross-site scripting vulnerability exists in Wyse Management Suite versions...