987 matches found
Huawei EulerOS: Security Advisory for ntp (EulerOS-SA-2019-2066)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-2561
CVE-2020-2561 affects Oracle PeopleSoft Enterprise HCM Human Resources (component: Company Dir / Org Chart Viewer) on version 9.2. The vulnerability is remote, exploitable over HTTP, and allows a low-privilege attacker to read a subset of data from the HCM HR module; CVSSv3.1 base score 4.3 (Conf...
Cross site scripting
ClickDesk version 4.3 and below has persistent cross site scripting...
CVE-2014-9211
ClickDesk version 4.3 and below has persistent cross site scripting...
Openfire 4.3.x < 4.5.0 Multiple XSS Vulnerabilities
Openfire is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2013-7062
Multiple cross-site scripting XSS vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the 1 browseridmanager or 2...
Security Bulletin: Cross frame scripting vulnerability in Connect:Enterprise HTTP (CVE-2013-6327)
Summary IBM Sterling Connect:Enterprise HTTP Option is vulnerable to cross frame scripting attacks. Vulnerability Details CVE ID: CVE-2013-6327 DESCRIPTION: IBM Sterling Connect:Enterprise HTTP Option could allow a cross-frame scripting attack, caused by improper validation of input within a fram...
EulerOS 2.0 SP3 : ntp (EulerOS-SA-2019-2637)
According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by...
Cyxtera Technologies Unspecified Vulnerability in Cyxtera AppGate SDP Client
Cyxtera Technologies Cyxtera AppGate SDP is a software-defined network border protection solution from Cyxtera Technologies, U.S.A. Cyxtera AppGate SDP Client is one of the client programs. A security vulnerability exists in Cyxtera Technologies Cyxtera AppGate SDP Client versions 4.1.x through...
PT-2019-15961 · Cyxtera · Cyxtera Appgate Sdp Client
Name of the Vulnerable Software and Affected Versions: Cyxtera AppGate SDP Client versions 4.1.x through 4.3.x before 4.3.2 Description: A local or remote user from the same domain can gain privileges in the affected software. Recommendations: For versions 4.1.x through 4.3.x before 4.3.2, update...
User enumeration leak using switch user functionality in Symfony
An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security...
DEBIAN-CVE-2019-18889
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache...
DEBIAN-CVE-2019-18886
An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security...
CVE-2010-3668
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secure download feature jumpurl...
CVE-2019-5533
In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail addre...
CVE-2019-2734
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session, Execute on DBMSADVISOR privilege with network access via OracleNet to...
Atlassian Jira Service Desk 4.3.x < 4.3.4 Path Traversal Vulnerability
According to its self-reported version number, the Atlassian Jira Service Desk application running on the remote host is prior to 3.9.16, 3.10.x prior to 3.16.8, 4.0.x prior to 4.1.3, 4.2.x prior to 4.2.5, 4.3.x prior to 4.3.4 or 4.4.x prior to 4.4.1. It is, therefore, affected by a path traversa...
Atlassian Jira Service Desk < 3.9.16 Path Traversal Vulnerability
According to its self-reported version number, the Atlassian Jira Service Desk application running on the remote host is prior to 3.9.16, 3.10.x prior to 3.16.8, 4.0.x prior to 4.1.3, 4.2.x prior to 4.2.5, 4.3.x prior to 4.3.4 or 4.4.x prior to 4.4.1. It is, therefore, affected by a path traversa...