Siemens LOGO! 8 BM 加密问题漏洞

Siemens LOGO! 8 BM is a programming software for industrial environments for the Windows platform from Siemens Germany. A security vulnerability exists in Siemens LOGO! 8 BM, which can be exploited by an attacker to gain unauthorized full access to all services...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.5, <=0.0.6), app.ariadust.dendrobium:app.ariadust.dendrobium.gradle.plugin (>=1.0.0, <=1.0.4) +4408 more potentially affected by CVE-2020-17521 via org.codehaus.groovy:groovy-all (>=2.0.0, <=2.4.20)

org.codehaus.groovy:groovy-all MAVEN version =2.0.0, =0.0.5, =1.0.0, =1.0.0, =0.0.2, =0.2.dev, =0.2.dev, =2.1.10, =2.2.11, =2.2.11, =2.0.0, =2.0.0, =3.5.4-rc.0, =3.5.9, =3.5.24 and more Source cves: CVE-2020-17521 Source advisory: MEND:CVE-2020-17521...

aspectj.aspectjgradleplugin:aspectj.aspectjgradleplugin.gradle.plugin (>=0.0.4, <=0.0.8), ch.artecat.jexler:jexler-core (4.0.0) +779 more potentially affected by CVE-2020-17521 via org.codehaus.groovy:groovy-all (>=2.5.0, <=2.5.13)

org.codehaus.groovy:groovy-all MAVEN version =2.5.0, =0.0.4, =1.0, =8.1.0.371, =8.1.0.304, =8.1.0.371, =8.1.0.516, =8.1.0.304, =8.1.0.286, =8.1.0.286, =8.1.0.371, =8.1.0.371, =8.1.0.286, =8.1.0.286, =8.1.0.371, =8.1.0.585.9 and more Source cves: CVE-2020-17521 Source advisory: MEND:CVE-2020-17521...

Cloudbees Jenkins 授权问题漏洞

Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . A security vulnerability exists in...

Cloudbees Jenkins 授权问题漏洞

Cloudbees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . CVS Plugin is used in one of the CVS versi...

Unbreakable Enterprise kernel security update

4.1.12-124.45.6 - qla2xxx: disable target reset during link reset and update version Quinn Tran Orabug: 32095664 - scsi: qla2xxx: Fix early srb free on abort Quinn Tran Orabug: 32095664 - scsi: qla2xxx: Fix comment in MODULEPARMDESC in qla2xxx Masanari Iida Orabug: 32095664 - scsi: qla2xxx: Enabl...

ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)

Exploit Title: ChurchCRM 4.2.1- Persistent Cross Site ScriptingXSS Date: 2020- 10- 29 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://churchcrm.io/ Software Link: https://github.com/ChurchCRM/CRM Version: 4.2.1 Tested on: Kali Linux 2020.3 Proof Of Concept: ChurchCRM application allo...

CVE-2020-26250

OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated in jupyterhub 1.2 configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by...

Moderate: Red Hat Security Advisory: rh-php73-php security, bug fix, and enhancement update

An update for rh-php73-php is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Chengdu Enable Technology Co., Ltd Vocational College Smart Campus Platform Has Logic Flaw Vulnerability

Chengdu Enable Technology Co., Ltd. is a high-tech enterprise and software enterprise in education informatization industry. A logic flaw vulnerability exists in the Vocational College Smart Campus Platform of Chengdu Enable Technology Co. An attacker can exploit the vulnerability to cause all...

fence security update

CentOS Errata and Security Advisory CESA-2020:5003 An update for fence-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2020-26548

An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system...

PT-2020-16451

Name of the Vulnerable Software and Affected Versions Aviatrix Controller versions prior to R5.4.1290 Description An issue was discovered in Aviatrix Controller where there is an insecure sudo rule, allowing a user to execute all commands as any user on the system. Recommendations For Aviatrix...

PT-2020-16353

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.6.9 Description The issue allows an attacker to list all orders placed on a website without being logged in by exploiting a function that recreates a shopping cart from an already placed order. Recommendations...

CVE-2020-8676

Improper access control in the IntelR Visual Compute Accelerator 2, all versions, may allow a privileged user to potentially enable escalation of privilege via local access...

eclipse:rhel8 bug fix update

Eclipse is an integrated development environment IDE. The metadata for the eclipse:rhel8 module has been updated to remove the following unused profiles: c everything To check whether you have the obsolete profiles installed, run: yum module list eclipse The installed profiles have the i indicato...

PYSEC-2020-18

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

PYSEC-2020-18

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

org.eclipse.jetty.aggregate:jetty-all (7.1.5.v20100705), org.eclipse.jetty.aggregate:jetty-all-server (7.1.5.v20100705) +23 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (7.1.5.v20100705)

org.eclipse.jetty:jetty-webapp MAVEN version 7.1.5.v20100705 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.5.v20100705 -...

org.eclipse.jetty.aggregate:jetty-all (7.1.0.v20100505), org.eclipse.jetty.aggregate:jetty-all-server (7.1.0.v20100505) +21 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (7.1.0.v20100505)

org.eclipse.jetty:jetty-webapp MAVEN version 7.1.0.v20100505 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.0.v20100505 -...