407 matches found
CVE-2020-3427
The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Windows Logon, cause Denia...
PT-2020-17248 · Microsoft · Windows Logon
Name of the Vulnerable Software and Affected Versions: Windows Logon versions prior to 4.1.2 Description: The issue allows an attacker with local user privileges to manipulate the installer into writing to arbitrary privileged directories by not properly validating file installation paths. This c...
bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...
PT-2020-6943 · Redmine · Redmine
Name of the Vulnerable Software and Affected Versions: Redmine versions prior to 4.0.8 Redmine versions 4.1.x prior to 4.1.2 Description: The issue is related to permission handling errors in the Redmine project and task management web application. Exploitation of this issue allows a remote...
Mattermost Server Input Validation Error Vulnerability (CNVD-2020-41500)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.3.0, 4.2.1 and 4.1.2. An attacker could exploit this vulnerability to cause a denial of service...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-41481)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.3.0, 4.2.1, and 4.1.2. An attacker can exploit this vulnerability to determine the existence of arbitrary files...
Mattermost Server Security Feature Issue Vulnerability
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.3.0, prior to 4.2.1, and prior to 4.1.2. An attacker could exploit the vulnerability to gain access to user accounts...
Mattermost Server Cross-Site Scripting Vulnerability (CNVD-2020-48232)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.3.0, 4.2.1 and 4.1.2. The vulnerability stems from the WEB application's lack of proper validation of client data. An attacke...
CVE-2017-18890
CVE-2017-18890 affects Mattermost Server prior to 4.3.0, 4.2.1, and 4.1.2. An attacker can craft a UI button that, when pressed by a user, triggers an API request. The vulnerability description across Red Hat/SUSE/SUSCVE and OSV confirms the same behavior and impact. Remediation guidance in sourc...
CVE-2017-18881
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a gotolocation response to a slash command...
EasyBuild Log Information Disclosure Vulnerability
EasyBuild is a software building and installation framework. A log information disclosure vulnerability exists in versions of EasyBuild prior to 4.1.2. The vulnerability stems from the abnormal output of log files from a networked system or product. No details of the vulnerability are provided at...
Information disclosure
In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...
PYSEC-2020-41
In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...
CVE-2014-9612
SQL injection vulnerability in remotereporter/loadlogfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to execute arbitrary SQL commands via the server parameter...
CVE-2019-9493
The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated attacker may be able to send commands to and retrieve data from a target MyCar unit. This may allow the attacker to learn the location of a target, or gain...
openSUSE Security Update : ffmpeg-4 (openSUSE-2020-24)
This update for ffmpeg-4 fixes the following issues : ffmpeg-4 was updated to version 4.0.5, fixes boo1133153 - CVE-2019-11339: The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 allowed remote attackers to cause a denial of service out-of-array access or possibly have...
ALE Alcatel-Lucent Omnivista 4760 and ALE Alcatel-Lucent Omnivista 8770 Remote Code Execution Vulnerabilities
The ALE Alcatel-Lucent Omnivista 4760 and the ALE Alcatel-Lucent Omnivista 8770 are both products of ALE France.The ALE Alcatel-Lucent Omnivista 4760 is a network management system. The product includes alarm notification, OmniPCX configuration, performance analysis and Voice over IP monitoring.A...
Fortinet FortiExtender Operating System Command Injection Vulnerability
Fortinet FortiExtender is a wireless WAN wide area network extender device from Fortinet. An operating system command injection vulnerability exists in Fortinet FortiExtender versions prior to 4.1.2, which can be exploited by an attacker to execute illegal operating system commands when the netwo...
CVE-2019-17179
4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1...