Python 2.7.x <= 2.7.17, 3.5 <= 3.5.9, 3.6.x <= 3.6.10, 3.7.x <= 3.7.6, 3.8.x <= 3.8.1 Regular Expression Denial of Service (ReDoS) Vulnerability - Windows

Python is prone to a Regular Expression Denial of Service ReDoS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-8492

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking...

PT-2020-20082 · Microsoft +2 · Windows 8 +3

Name of the Vulnerable Software and Affected Versions: Python CPython versions 3.6 through 3.6.10 Python CPython versions 3.7 through 3.7.6 Python CPython versions 3.8 through 3.8.1 Description: An insecure dependency load upon launch on Windows 7 may result in an attacker's copy of...

CVE-2020-2659

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols...

Oracle Hospitality Suites Management CVE-2020-2697 Local Security Vulnerability

Description Oracle Hospitality Suites Management is prone to a local security vulnerability. The vulnerability can be exploited over the 'HTTP' protocol. The 'Request Tracker' package is affected. This vulnerability affects the following supported versions: 3.7, 3.8 Technologies Affected Oracle...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-02447)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress versions 3.7 through 5.3.0. The vulnerability stems...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-02541)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress versions 3.7 through 5.3.0. The vulnerability stems...

CVE-2019-14879

A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the associated capabilities were not being revoked where applicable...

DEBIAN-CVE-2019-20042

In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wptargetedlinkrel can be used in a particular way to result in a stored cross-site scripting XSS vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a mino...

UBUNTU-CVE-2019-20042

In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wptargetedlinkrel can be used in a particular way to result in a stored cross-site scripting XSS vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a mino...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django

djangocve201919844poc PoC for CVE-2019-19844https://www...

Siemens SIMATIC Products (Update C)

1. EXECUTIVE SUMMARY CVSS v3 3.7 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SIMATIC CP 1626; HMI Panel incl. SIPLUS variants; NET PC software; STEP 7 TIA Portal; WinCC TIA Portal; WinCC OA; WinCC Runtime Pro and Advanced; TIM 1531 IRC incl. SIPLUS variant Vulnerability: Exposed...

Moodle Cross-Site Scripting Vulnerability (CNVD-2019-43888)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in Moodle versions 3.7 through 3.7.2, which stems from a lack of proper validation of clien...

Unspecified vulnerability in Moodle (CNVD-2019-43886)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle versions 3.7 through 3.7.2 and 3.6 through 3.6.6, which stems from a failure of the Email med...

XML Notepad 2.8.0.4 - XML External Entity Injection Exploit

Exploit Title: XML Notepad 2.8.0.4 - XML External Entity Injection Exploit Author: 8-Team / daejinoh Vendor Homepage: https://www.microsoft.com/ Software Link: https://github.com/microsoft/XmlNotepad Version: XML Notepad 2.8.0.4 Tested on: Windows 10 Pro CVE : N/A Step 1 File - Open - .xml Exploi...

LabF nfsAxe FTP client buffer overflow vulnerability

LabF nfsAxe FTP client is a file transfer client program. A buffer overflow vulnerability in LabF nfsAxe FTP client version 3.7 can be exploited by remote attackers to execute code...

FreeBSD : python 3.7 -- multiple vulnerabilities (9b7491fb-f253-11e9-a50c-000c29c4dc65)

Python changelog : bpo-38243: Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML. bpo-38174: Update vendorized expat library version to 2.2.8, which resolves CVE-2019-15903. bpo-37764: Fixes email.headervalueparser.getunstructured going into an...

CVE-2019-13657

CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...

CVE-2019-2992

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2019-2987

Vulnerability in the Java SE product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this...