140 matches found
BIT-SUITECRM-2021-41869
SuiteCRM 7.10.x before 7.10.33 and 7.11.x before 7.11.22 is vulnerable to privilege escalation...
CVE-2023-2905 Cesanta Mongoose MQTT Message Parsing Heap Overflow
Due to a failure in validating the length of a provided MQTTCMDPUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not...
CVE-2023-2905 Cesanta Mongoose MQTT Message Parsing Heap Overflow
Due to a failure in validating the length of a provided MQTTCMDPUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not...
SAP Enterprise Portal 跨站脚本漏洞
SAP Enterprise Portal is an application from SAP, Germany. A comprehensive integration and application platform that facilitates the alignment of people, information and business processes across organizational and technological boundaries. A cross-site scripting vulnerability in SAP Enterprise...
SuiteCRM 跨站脚本漏洞
SuiteCRM is a customer relationship management system from the SuiteCRM Suitecrm team.SuiteCRM versions prior to 7.10.35, 7.11.x, and 7.12.x prior to 7.12.2 have a security vulnerability that could be exploited by an attacker to introduce arbitrary JavaScript via attachment upload...
CVE-2021-41869
SuiteCRM 7.10.x before 7.10.33 and 7.11.x before 7.11.22 is vulnerable to privilege escalation...
CVE-2021-41869
SuiteCRM 7.10.x prior to 7.10.33 and 7.11.x prior to 7.11.22 are vulnerable to privilege escalation. The corroborating sources list the affected ranges and confirm the fix versions: 7.10.33 and 7.11.22. Root cause details are not provided in the documents, and there is no exploitation status repo...
PT-2021-22725 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 7.11.0 and later Description: The issue is related to missing authentication in GitLab CE/EE, which allows an attacker with access to a victim's session to disable two-factor authentication. Recommendations: For GitLab...
PT-2021-6147 · Sap · Sap Netweaver Development Infrastructure Component Build Service
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Development Infrastructure Component Build Service versions 7.11 through 7.50 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability in the SAP NetWeaver Development Infrastructure Component Build...
SAP NetWeaver AS JAVA Information Disclosure (3023299)
SAP Netweaver Application Server Java versions 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allow an attacker to access restricted information by entering malicious server name via the UserAdmin application of the SAP NetWeaver application server. Note that Nessus has not tested for this issue but has...
Siren Federate 安全漏洞
Siren Federate is an application from Siren Ireland. It extends the Elasticsearch API to add high performance and scalable joins. A security vulnerability exists in Siren Federate that discloses user information across thread contexts when a low-privileged user and a high-privileged user execute...
CVE-2021-22158
The Proofpoint Insider Threat Management Server formerly ObserveIT Server is vulnerable to XML external entity XXE injection in the Web Console. The vulnerability requires admin user privileges and knowledge of the XML file's encryption key to successfully exploit. All versions before 7.11 are...
SAP NetWeaver AS JAVA Reverse Tabnabbing (2976947)
SAP Netweaver Application Server Java Applications based on WebDynpro Java versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. Note that Nessus has not tested for this issue but has instead...
Design/Logic Flaw
SAP Netweaver Application Server Java Applications based on WebDynpro Java versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities...
SAP Netweaver AS JAVA Authorization Issues Vulnerability
SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An authorization issue vulnerability exists in SAP Netweaver AS JAVA P2P Cluster Communication versions 7.11,...
CVE-2019-8638
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 5.2, iCloud for Windows 7.11, iOS 12.2, iTunes 12.9.4 for Windows, Safari 12.1. Processing maliciously crafted web content may lead to arbitrary code execution...
CVE-2020-6370
SAP NetWeaver Design Time Repository DTR, versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...
CVE-2019-7292
A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may result in the disclosure of process memory...
CVE-2019-18785
Summary: CVE-2019-18785 affects SuiteCRM 7.10.x before 7.10.21 and 7.11.x before 7.11.9, due to mishandling of API access tokens and credentials. The available connected documents confirm the affected versions and the behavior but do not provide concrete technical details on root cause beyond tok...