244 matches found
Design/Logic Flaw
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportuni...
Security fix for the ALT Linux 10 package postgresql12 version 12.5-alt1
Nov. 16, 2020 Alexei Takaseev 12.5-alt1 - 12.5 Fixes CVE-2020-25694, CVE-2020-25695, CVE-2020-25696...
Security fix for the ALT Linux 9 package postgresql12-1C version 12.5-alt1
Nov. 16, 2020 Alexei Takaseev 12.5-alt1 - 12.5 Fixes CVE-2020-25694, CVE-2020-25695, CVE-2020-25696 - Re-applay patch from 1C...
Vulnerabilities fixed in PostgreSQL
Several vulnerabilities have been fixed in PostgreSQL. A local malicious person with limited privileges within the vulnerable PostgreSQL database, could potentially exploit the vulnerabilities to within the database or on the local system to execute arbitrary code execute arbitrary code with root...
RCE in XWiki
Impact Any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. Patches It has been patched in both version XWi...
CVE-2020-16171
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is afterwards used in a separate web request issued by the application itself. This can be abused to conduct...
Acronis Cyber Backup 12.5 Build 16341 Server-Side Request Forgery
RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Acronis Cyber Backup Vendor URL: https://www.acronis.com Type: Server-Side Request Forgery CWE-918 Date found: 2020-07-30 Date published: 2020-09-14 CVSSv3 Score: 8.3...
PT-2020-13406 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.5 through 13.0.1 Description: The issue allows users to bypass email verification. Recommendations: For GitLab CE/EE versions 12.5 through 13.0.1, update to a version that contains a fix for this issue...
GitLab HTML Injection Vulnerability (CNVD-2020-19602)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 12.5...
CVE-2020-10088
GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level...
CVE-2020-10088
GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level...
CVE-2020-10088
GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level...
PT-2020-11900 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 12.5 through 12.8.1 Description: The issue concerns HTML Injection in a particular error header, potentially allowing injection or other vulnerabilities via unescaped input. Recommendations: For versions 12.5 through 12.8.1,...
PT-2020-11913 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 12.5 through 12.8.1 Description: The issue concerns Insecure Permissions in GitLab. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level. Recommendations: For...
Cisco Finesse Cross-Site Scripting Vulnerability (CNVD-2020-10505)
Cisco Finesse is a next-generation seat and supervisor desktop designed to provide a collaborative experience for the diverse communities that interact with your customer service organization. A cross-site scripting vulnerability exists in the Web management interface of Cisco Finesse versions...
Cisco Unified Contact Center Express Command Execution Vulnerability
Cisco Unified Contact Center Express Unified CCX is a customer relationship management component of a unified communications solution from Cisco. The component supports features such as self-service voice, call distribution, and customer access control. A code issue vulnerability exists in Cisco...
GitLab EE Insecure Direct Object Reference Vulnerability
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is GitLab Enterprise Edition. GitLab EE 11.3 - 12.5 suffers from an insecure direct object...
GitLab EE Token Plaintext Storage Vulnerability
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is GitLab Enterprise Edition. A token explicit storage vulnerability exists in GitLab EE 8...