1232 matches found
Command Injection
Overview mversion is a cross packaging manager module version handler/bumper. Affected versions of this package are vulnerable to Command Injection. The issue occurs because tagName user input is formatted inside the exec function is executed without any checks. PoC: var mversion =...
CVE-2020-4428
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533...
CVE-2020-4429
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534...
CVE-2020-4428
Product and vuln : IBM Data Risk Manager (IDRM) 2.0.1–2.0.4. Issue : remote authenticated attacker can execute arbitrary commands on the system (CVE-2020-4428). Root cause / vector : authenticated access with remote command execution capability (no user interaction required). Impact : full comman...
PT-2020-6500 · Ibm · Ibm Data Risk Manager
Name of the Vulnerable Software and Affected Versions: IBM Data Risk Manager versions 2.0.1 through 2.0.4 Description: The issue is related to the failure to neutralize special elements used in operating system commands, which can be exploited by a remote attacker to execute arbitrary commands on...
PT-2020-6501 · Ibm · Ibm Data Risk Manager
Name of the Vulnerable Software and Affected Versions: IBM Data Risk Manager versions 2.0.1 through 2.0.4 Description: The issue is related to insufficient path validation in the IBM Data Risk Manager application, allowing a remote attacker to traverse directories and download arbitrary files by...
IBM Data Risk Manager Arbitrary File Download
IBM Data Risk Manager IDRM contains two vulnerabilities that can be chained by an unauthenticated attacker to download arbitrary files off the system. The first is an unauthenticated bypass, followed by a path traversal. This module exploits both vulnerabilities, giving an attacker the ability to...
firefox security update
68.7.0-2.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 68.7.0-2 - Update to 68.7.0 build3...
JVN#89224521: Multiple vulnerabilities in EasyBlocks IPv6
EasyBlocks IPv6 provided by Plat'Home Co., Ltd. contains multiple vulnerabilities listed below. Cross site request forgeryCWE-352 - CVE-2020-5549 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N| Base Score: 4.3 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:N| Base...
CVE-2020-5558
CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors...
CVE-2020-5557
Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Code injection
CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors...
CVE-2020-5558
CVE-2020-5558 affects CuteNews 2.0.1 (CutePHP CuteNews). A remote authenticated attacker can execute arbitrary PHP code due to a PHP code execution vulnerability (CWE-94). Impact described by NVD: high severity (CVSS v3.1 base score 8.8), network attack vector, low attack complexity, privileges r...
CVE-2020-5557
Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2020-5557
The CVE-2020-5557 entry covers a cross-site scripting vulnerability (CWE-79) in CuteNews 2.0.1. Affected software is CuteNews/CutePHP’s News module version 2.0.1; the root cause is an XSS flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Impact desc...
CutePHP CuteNews Injection Vulnerability
CutePHP CuteNews is a news management system. The system has features such as search, file upload management, access control, backup and restore. An injection vulnerability exists in CutePHP CuteNews version 2.0.1. A remote attacker can exploit this vulnerability to execute arbitrary PHP code...
firefox security update
68.5.0-2.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file Fri Feb 07 2020 Jan Horak - Update to 68.5.0 build2 Wed Feb 05 2020 Jan Horak - Update to 68.5.0 build...
CVE-2020-5215
In TensorFlow before 1.15.2 and 2.0.1, converting a string from Python to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker c...
PYSEC-2020-303
In TensorFlow before 1.15.2 and 2.0.1, converting a string from Python to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker c...