SAP Solution Manager remote unauthorized OS commands execution

This module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet tcsmdagentapplicationeem of SAP Solution Manager SolMan running version 7.2. The vulnerability occurs due to missing authentication checks when submitting a SOAP request to the /EemAdminService/EemAdmin page to get...

Exploit for CVE-2020-13933

CVE-2020-13933 – Test Bed shiro: Permission configuration...

SUSE-SU-2020:1569-2 Security update for java-1_8_0-openjdk

This update for java-180-openjdk to version jdk8u252 fixes the following issues: - CVE-2020-2754: Forward references to Nashorn bsc1169511 - CVE-2020-2755: Improve Nashorn matching bsc1169511 - CVE-2020-2756: Better mapping of serial ENUMs bsc1169511 - CVE-2020-2757: Less Blocking Array Queues...

PT-2020-15427 · Jenkins · Jenkins Github Coverage Reporter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitHub Coverage Reporter Plugin versions 1.8 and earlier Jenkins GitHub Coverage Reporter Plugin versions 1.10 and earlier Description: The issue concerns the storage of secrets in plain text in the global configuration file on the...

PlayTube Path Traversal Vulnerability

PlayTube is a PHP-based video sharing platform. A security vulnerability exists in PlayTube version 1.8. An attacker can exploit the vulnerability to obtain user details...

CVE-2020-13792

PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion...

Directory traversal

PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion...

CVE-2020-13792

PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion...

CVE-2020-13792

PlayTube 1.8 is affected by a directory traversal/local file inclusion vulnerability that allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users. The issue is triggered by traversing the server file path to reach sensitive user information. The connected rec...

taglib security update

1.8-8.20130218git - Fixed OOB read when loading invalid ogg flac file Resolves: bz1585260...

CVE-2020-11100

In hpackdhtinsert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution...

Remote code execution

In hpackdhtinsert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution...

VulnCheck KEV: CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

PT-2020-15330 · Jenkins · Jenkins Radargun Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins RadarGun Plugin versions 1.7 and earlier Description: The issue is related to the configuration of the YAML parser in the Jenkins RadarGun Plugin, which does not prevent the instantiation of arbitrary types. This results in a remote...

Fedora 30 : xar (2020-bbd24dd0cf)

The remote Fedora 30 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2020-bbd24dd0cf advisory. - Use Apple upstream instead of non-fresh Github one - New upstream in 1.8 dev branch with 417.1 subversion - Close CVE-2018-17093 - Close...

Transcend WiFiSD Cross-Site Scripting Vulnerability

Transcend WiFiSD is a WiFi-enabled memory card product from Transcend Taiwan, China. A cross-site scripting vulnerability exists in Transcend WiFiSD version 1.8. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the...

VMware Harbor 1.7.x, 1.8.x < 1.8.6 / 1.9.x < 1.9.3

The version of VMware Harbor installed on the remote host is 1.7.x or 1.8.x prior to 1.8.6 or 1.9.x prior to 1.9.3. It is, therefore, affected multiple vulnerabilities, including the following: - A privilege escalation vulnerability that allows an authenticated, normal user to gain administrative...

CVE-2013-5638

Transcend WiFiSD 1.8 has persistent XSS...

CVE-2013-5638

The CVE-2013-5638 entry concerns Transcend WiFiSD 1.8, where a persistent cross-site scripting (XSS) vulnerability exists in the web application. The root cause is described as lack of proper validation of client-side data by the WEB application, enabling an attacker to execute client-side code. ...

CloudBees Jenkins buildgraph-view Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . A cross-site scripting vulnerability exists in CloudBees Jenkins buildgraph-view Plugin 1.8 and earlier versions. The vulnerability stems from a WEB application t...