1736 matches found
Authentication flaw
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System NATS messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized...
PT-2020-15415 · Jenkins · Jenkins Sonargraph Integration Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Sonargraph Integration Plugin versions 3.0.0 and earlier Description: The issue results in a stored cross-site scripting vulnerability due to the failure to escape the file path for the Log file field form validation. This can be...
Stored XSS vulnerability in sonargraph-integration
sonargraph-integration 3.0.0 and earlier does not escape the file path for the Log file field form validation. This results in a stored cross-site scripting XSS vulnerability that can be exploited by users with Job/Configure permission. sonargraph-integration 3.0.1 escapes the affected part of th...
CVE-2020-5900
In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery CSRF protections for the NGINX Controller user interface...
Fedora 32 : lynis (2020-f251753b0f)
Update to 3.0.0 rhbz 1848716, fixes CVE-2020-13882 / CVE-2019-13033 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...
PT-2020-14107 · Fabien Sanglard +2 · Crispy Doom +2
Name of the Vulnerable Software and Affected Versions: Chocolate Doom version 3.0.0 Crispy Doom version 5.8.0 Description: The issue arises from the server's failure to validate the user-controlled num players value, resulting in a buffer overflow. This allows a malicious user to overwrite the...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-35331)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.0.0. An attacker could exploit the vulnerability to view account details...
CVE-2016-11079
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details...
EC-CUBE Path Traversal Vulnerability
EC-CUBE is Japan's EC-CUBE company's set of open source e-commerce system . A path traversal vulnerability exists in EC-CUBE versions 3.0.0 through 3.0.18 and 4.0.0 through 4.0.3. An attacker could exploit this vulnerability to delete arbitrary files or paths on the server...
jenkins-git-client-plugin: OS command injection via 'git ls-remote'
Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection...
F5 NGINX Controller Authorization Issue Vulnerability (CNVD-2020-51553)
F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. An authorization issue vulnerability exists in F5 NGINX Controller versions 3.0.0 through 3.4.0 in NGINX Controller...
F5 NGINX Controller Cross-Site Request Forgery Vulnerability
F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A cross-site request forgery vulnerability exists in the NGINX Controller user interface in F5 NGINX Controller...
Wireshark Security Update (wnpa-sec-2020-08) - Windows
Wireshark is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"...
NewStart CGSL CORE 5.04 / MAIN 5.04 : xerces-c Vulnerability (NS-SA-2020-0028)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xerces-c packages installed that are affected by a vulnerability: - The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been...
WSO2 API Manager Code Issue Vulnerability
WSO2 API Manager is a suite of API lifecycle management solutions from WSO2, Inc. A code issue vulnerability exists in WSO2 API Manager version 3.0.0, which stems from the program's failure to properly restrict network access to Publisher nodes, and can be exploited by attackers to obtain sensiti...
CVE-2020-1955
CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called requirevaliduserexceptforup. It was meant as an extension to the long standing setting requirevaliduser, which in turn requires that any and all requests to CouchDB will...
CVE-2020-1955
CVE-2020-1955 affects CouchDB 3.0.0 where the new require_valid_user_except_for_up setting was intended to require credentials for all endpoints except /_up, but a defect caused credentials not to be enforced at any endpoint when enabled. Multiple sources (NVD/NIST entry, OSV, SUSE and Nessus/Ope...
CouchDB 3.0.0 Remote Elevation of Privilege Vulnerability
CouchDB is a document-oriented database system developed using Erlang . A remote elevation of privilege vulnerability exists in CouchDB 3.0.0, which can be exploited by an attacker to gain server privileges...
