ZyXEL pre-authentication command injection in weblogin.cgi

Overview Multiple ZyXEL devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. Description CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command...

Spoofing

The OG access fields visibility fields implementation in Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via...

PT-2020-1843 · Abb · Abb Esoms

Name of the Vulnerable Software and Affected Versions: ABB eSOMS versions 3.9 to 6.0.3 Description: The issue is related to a lack of input checks for SQL queries, which might allow an attacker to perform SQL injection attacks against the backend database. This could potentially be exploited by a...

PT-2020-15329 · Jenkins · Jenkins Brakeman Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Brakeman Plugin versions 0.12 and earlier Description: The issue is related to a stored cross-site scripting vulnerability. It occurs because the plugin does not escape values received from parsed JSON files when rendering them. This...

PT-2020-15338 · Jenkins · Jenkins Eagle Tester Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Eagle Tester Plugin versions 1.0.9 and earlier Description: The issue concerns the storage of a password in an unencrypted form in the global configuration file on the Jenkins master. This allows users with access to the master file...

PT-2020-20354 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.121 Description: An issue was discovered in the Galaxy view, where an incorrectly sanitized search string was found in app/View/Galaxies/view.ctp. Recommendations: For versions prior to 2.4.121, update to version...

PT-2020-9918 · Apache · Apache Dubbo

Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions 2.5.x Apache Dubbo versions 2.6.0 through 2.6.7 Apache Dubbo versions 2.7.0 through 2.7.4 Description: Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a PO...

CVE-2014-7863

The FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to 1 read arbitrary...

CVE-2014-7863

The CVE-2014-7863 issue affects the FailOverHelperServlet (FailServlet) in ZOHO ManageEngine OpManager, Applications Manager, and IT360, allowing (1) arbitrary file read via the fileName parameter in a copyfile operation and (2) directory-listing disclosure via listdirectory. Technical details ar...

CVE-2014-9127

Open-School Community Edition 2.2 is affected by CVE-2014-9127: an access control bypass in the export feature allows remote authenticated users to view sensitive data via the r parameter set to export on index.php. The issue enables partial confidentiality impact as described in the CVE entry, w...

CVE-2014-9127

Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php...

[ASA-202002-3] chromium: multiple issues

Arch Linux Security Advisory ASA-202002-3 ========================================= Severity: Critical Date : 2020-02-06 CVE-ID : CVE-2019-18197 CVE-2019-19880 CVE-2019-19923 CVE-2019-19925 CVE-2019-19926 CVE-2020-6381 CVE-2020-6382 CVE-2020-6385 CVE-2020-6387 CVE-2020-6388 CVE-2020-6389...

PT-2020-20253

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.3 EyesOfNetwork API version 2.4.2 Description An issue was discovered that allows an unauthenticated attacker to perform various tasks, including authentication bypass via the username field. This is due to SQL injectio...

Ghostscript access restriction bypass vulnerability

Overview Ghostscript provided by Artifex Software Inc. contains an access restriction bypass vulnerability CWE-284. Hiroki MATSUKUMA of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

JVN#52486659: Ghostscript access restriction bypass vulnerability

Ghostscript provided by Artifex Software Inc. contains an access restriction bypass vulnerability CWE-284. Impact By Ghostscript processing a specially crafted file, arbitrary command may be executed with the privilege of Ghostscript. Solution Update the Software Update the software according to...

PT-2020-7565 · D Link · D-Link Dir-100

Name of the Vulnerable Software and Affected Versions: D-Link DIR-100 version 4.03B07 Description: The issue is related to a security bypass due to an error in the cliget.cgi script. Recommendations: For D-Link DIR-100 version 4.03B07, consider restricting access to the cliget.cgi script as a...

CVE-2014-4859

Integer overflow in the Drive Execution Environment DXE phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data...

CVE-2013-4187

The Flippy module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to nodes, which allows remote authenticated users with the permission to access content to read a link or alias to a restricted node...

CVE-2013-4187

The Flippy module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to nodes, which allows remote authenticated users with the permission to access content to read a link or alias to a restricted node...

PT-2020-20148 · Trend Micro · Ossec-Hids

Name of the Vulnerable Software and Affected Versions: OSSEC-HIDS versions 2.7 through 3.5.0 Description: The issue affects the server component responsible for log analysis, ossec-analysisd, which is vulnerable to a denial of service due to a NULL pointer dereference. This can be triggered by...