CVE-2021-33581

MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the availability of a PPM connection. This occurs in com.idsscheer.ppmmashup.web.webservice.impl.ZPrestoAdminWebService...

GitLab 10.7.x - 10.7.6, 10.8.x - 10.8.5, 11.1.x - 11.1.4, 11.2.x - 11.2.1 XSS Vulnerability

GitLab is prone to a missing authorization control vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitlab:gitlab";...

Validate the Efficacy of your Endpoint Security Controls Continuously with Breach and Attack Simulations

Validate the efficacy of your Endpoint Security controls continuously with Breach and Attack Simulations By Nicolas Stricher, Trellix XDR solution Architect, EMEA and Doron RosenbergTrellix Senior Sales Engineer, Israel · March 4, 2022 Efficacy of Trellix Endpoint Security At Trellix we are proud...

PT-2021-7209 · Mariadb +5 · Mariadb Server +5

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions prior to 10.7 Description: The issue is related to a denial of service vulnerability in the xbstream open method, located in extra/mariabackup/ds xbstream.cc. When an error occurs, specifically when stream ctxt-dest fi...

CVE-2020-28846

Cross Site Request Forgery CSRF vulnerability exists in SeaCMS 10.7 in adminmanager.php, which could let a malicious user add an admin account...

CVE-2020-28846

Cross Site Request Forgery CSRF vulnerability exists in SeaCMS 10.7 in adminmanager.php, which could let a malicious user add an admin account...

Improper access control

ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could...

CVE-2019-8773

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, iCloud for Windows 7.14, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to...

CVE-2019-8746

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6, iTunes 12.10.1 for Windows...

Cross site scripting

A validation issue was addressed with improved logic. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, tvOS 13, iCloud for Windows 7.14, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to universal cross site scripting...

CVE-2019-8763

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary...

CVE-2019-8625

A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to universal cross site scripting...

Hardcoded credentials

IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 181395...

CVE-2020-4459

CVE-2020-4459 concerns IBM Security Secret Server (all editions) with a root cause of hard-coded credentials used for authentication, external communication, or internal data encryption. The connected IBM advisory indicates the vulnerability is addressed by upgrading to version 10.8 (remediation)...

CVE-2020-4327

IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 177599...

CVE-2020-4341

IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178181...

Cross site scripting

IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177514...

CVE-2020-4342

CVE-2020-4342 concerns IBM Security Secret Server. The vulnerability allows an unauthorized user to disclose sensitive information contained in installation files. Affected software is IBM Security Secret Server (all versions prior to 10.8, per IBM bulletin). The root cause is an information disc...

CVE-2020-4327

CVE-2020-4327 affects IBM Security Secret Server. All versions prior to 10.8 may disclose sensitive information when a detailed browser error message is returned, enabling a remote attacker to obtain data. IBM’s bulletin indicates the workaround is upgrading to version 10.8 (remediation). CVSS me...

CVE-2020-4323

CVE-2020-4323 affects IBM Security Secret Server (v10.7). The issue is a cross-site scripting vulnerability in the Web UI that allows embedding arbitrary JavaScript, potentially enabling credential disclosure within a trusted session. The NVD notes CVSS v3.1 base score 6.1 (AV:N/AC:L/PR:N/UI:R/S:...