Moderate: Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 13 bug fix and enhancement advisory

Updated packages that resolve various issues are now available for Red Hat OpenStack Platform 13.0 Queens for RHEL 7. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service IaaS cloud running on commonly available...

CVE-2012-1094: Exposure of Sensitive Information to an Unauthorized Actor

JBoss AS 7 prior to 7.1.1 and modcluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed...

CVE-2020-6205: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver AS ABAP Business Server Pages Smart Forms, SAPBASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not sufficiently encode user controlled inputs, allowing an unauthenticated attacker to non-permanently deface or modify displayed content...

PT-2020-7176

Name of the Vulnerable Software and Affected Versions JBoss AS 7 versions prior to 7.1.1 Description The issue arises from the different handling of default hostname by JBoss AS 7 and mod cluster, leading to a mismatch in the excluded-contexts list and potentially exposing the root context...

KLA11688 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code, inject malicious code. Below is a complete list of vulnerabilities: 1. Out of bounds vulnerability can be...

A week in security (February 17 – 23)

Last week on Malwarebytes Labs, we highlighted the benefits and concerns of identity-as-a-service IDaaS, an identity management scheme deployed from the cloud; reported on scammers and squatters taking advantage of Rudy Giuliani’s Twitter typos; and gave a high-level overview of RobbinHood, the...

M-Trends 2020: Insights From the Front Lines

Today we release M-Trends 2020, the 11th edition of our popular annual FireEye Mandiant report. This latest M-Trends contains all of the statistics, trends, case studies and hardening recommendations that readers have come to expect through the years—and more. One of the most exciting takeaways...

Design/Logic Flaw

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl executed as root by crond and /root/loadperl.sh executed as root at boot time scripts...

The vulnerability of the Cisco Hosted Collaboration Mediation Fulfillment software’s web interface allows a perpetrator to perform arbitrary actions in the context of the current user.

The vulnerability of the Cisco Hosted Collaboration Mediation Fulfillment software web interface is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor, operating remotely, to perform arbitrary actions in the context of the current user, usin...

Logic flaw vulnerability in the uc***.php file in the frontend of Five Fingers CMS

Five Fingers CMS is an open source content management system. A logic flaw vulnerability exists in the uc.php file in the frontend of Five Fingers CMS. Attackers can use the vulnerability to log in to any user , access sensitive information , to perform unauthorized operations...

CVE-2020-6190

CVE-2020-6190 affects SAP NetWeaver AS Java (Heap Dump Application). Vulnerable endpoints in versions 7.30, 7.31, 7.40, 7.50 can disclose system information such as hostname, server node, and installation path. The underlying impact is information disclosure. The provided documents describe the a...

PT-2020-18993

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java Heap Dump Application versions 7.30, 7.31, 7.40, 7.50 Description The issue allows attackers to gain valuable information about the system, including hostname, server node, and installation path, through certain vulnerabl...

CVE-2020-6190: Exposure of Sensitive Information to an Unauthorized Actor

Certain vulnerable endpoints in SAP NetWeaver AS Java Heap Dump Application, versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server node and installation path that could be misused by an attacker leading to Information Disclosure...

CVE-2020-8771

The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWPJSONPREFIX causes the client to be logged in as the first account on the list of administrator accounts...

SQL injection vulnerability in As***.class.php file of ShopsN single merchant b2c mall system

ShopsN single merchant b2c mall system is an open source online store system developed using PHP + MySQL. ShopsN single merchant b2c mall system As.class.php file SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...

CVE-2019-20442

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in roleToAuthorize has been identified in the registry UI...

PT-2020-10454

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 WSO2 Enterprise Integrator version 6.5.0 WSO2 IS as Key Manager version 5.7.0 WSO2 Identity Server version 5.8.0 Description A potential stored Cross-Site Scripting XSS vulnerability has been identified in the...

CVE-2019-20443: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in mediaType has been identified in the registry UI...

PT-2020-10453

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 WSO2 Enterprise Integrator version 6.5.0 WSO2 IS as Key Manager version 5.7.0 WSO2 Identity Server version 5.8.0 Description A potential stored Cross-Site Scripting XSS vulnerability has been identified in the...

CVE-2019-20442: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in roleToAuthorize has been identified in the registry UI...