633 matches found
CVE-2020-26234 Disabled Hostname Verification in OpenCast
Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for...
CVE-2020-13671
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to...
Drupal 7.x, 8.x, 9.x RCE Vulnerability (SA-CORE-2020-012) - Linux
Drupal is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...
CVE-2020-13671
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to...
Pixar OpenUSD Binary File Format Compressed Value Reps Code Execution Vulnerabilities
Summary A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap overflow, which can result in remote code execution. To trigger this vulnerability, the victim needs to acce...
Security Bulletin: A vulnerability in OpenJDK Java Runtime Environment (JRE) affect IBM Spectrum Conductor 2.4.1
Summary There is a vulnerability in OpenJDK Java Runtime Environment JRE used by IBM Spectrum Conductor 2.4.1. IBM Spectrum Conductor 2.4.1 has addressed the applicable vulnerability. Vulnerability Details Third Party Entry: 185972 DESCRIPTION: Oracle JDK and OpenJDK JavaFX code execution CVSS Ba...
nejm.org Cross Site Request Forgery vulnerability OBB-1255151
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 - Includes Oracle Jan 2020 CPU affect IBM Content Classification
Summary There is vulnerability in IBM® Runtime Environment Java™ Version 6 and Java™ 7 that is used by IBM Content Classification. This issue was disclosed as part of the IBM Java SDK updates in Jan 2020. Vulnerability Details CVEID: CVE-2020-2805 DESCRIPTION: An unspecified vulnerability in Java...
Rockwell Automation FactoryTalk View SE
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low skill level to exploit Vendor: Rockwell Automation Equipment: FactoryTalk View SE Vulnerabilities: Cleartext Storage of Sensitive Information, Weak Encoding for Password 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead...
zaiko.io Cross Site Request Forgery vulnerability OBB-1192263
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update J)
1. EXECUTIVE SUMMARY --------- Begin Update K Part 1 of 2 --------- CVSS v3 8.8 --------- End Update K Part 1 of 2 --------- ATTENTION: Low attack complexity Vendor: Siemens Equipment: SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK Vulnerability: Unquoted Search Path or Element 2. UPDATE...
squarelovin.com Cross Site Request Forgery vulnerability
Open Bug Bounty ID: OBB-1164939 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
deltapublishing.co.uk Cross Site Request Forgery vulnerability
Open Bug Bounty ID: OBB-1155584 Security Researcher Manojkhd Helped patch 44 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting deltapublishing.co.uk website and its users. Following...
vppbazzar.com Cross Site Request Forgery vulnerability
Open Bug Bounty ID: OBB-1134998 Security Researcher Manojkhd Helped patch 43 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting vppbazzar.com website and its users. Following...
Advantech WebAccess
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WebAccess Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow remote code execution. 3. TECHNICAL DETAILS 3.1...
shavemac.com Cross Site Request Forgery vulnerability
Security Researcher error404 Helped patch 520 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting shavemac.com website and its users. Following coordinated...
CVE-2020-7977
Removed by vendor...
PT-2020-19892 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE versions 8.8 through 12.7.2 Description: The issue concerns insecure permissions in GitLab EE. Recommendations: For GitLab EE versions 8.8 through 12.7.2, update to a version later than 12.7.2 to resolve the issue...
Security Bulletin: Input Validation Vulnerability in Watson Studio Local
Summary A lack of input validation offered an attack vector in several API calls. This vulnerability is addressed Vulnerability Details Third Party Entry: PSIRT-ADV0011811 DESCRIPTION: CVSS Base score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products and Versions...
Drupal Core SA-CORE-2019-010 Multiple Security Vulnerabilities
Description Drupal is prone to multiple security vulnerabilities. An attacker can exploit these issues to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. Drupal versions 8.7.x prior to 8.7.11 and versions 8.8.x prior to 8.8.1 are...