mysql: C API unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client...

Openfire < 4.5.2 Multiple XSS Vulnerabilities

Openfire is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

RUSTSEC-2020-0166 personnummer Input validation error

Swedish personal identity is in the form of YYMMDD-XXXX An issue arises from the regular expression allowing the first three digits in the last four digits of the personnummer to be 000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure...

PT-2020-13523 · Mosca · Moscajs Aedes

Name of the Vulnerable Software and Affected Versions: MoscaJS Aedes version 0.42.0 Description: An issue was discovered in the handling of exceptions during the writing of an invalid packet to a stream in lib/write.js. Recommendations: For version 0.42.0, update to version 0.42.1 to resolve the...

Tiki Wiki CMS Groupware < 21.2 XSS Vulnerability

Tiki Wiki CMS Groupware is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

chromium-browser: Use after free in ANGLE

Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

D-Link DAP-1522 Authentication Bypass Vulnerability

The D-Link DAP-1522 is a wireless access point product from AUO D-Link of Taiwan, China. A security vulnerability exists in version 1.4x of the D-Link DAP-1522 prior to 1.10b04Beta02. An attacker can exploit the vulnerability to bypass authentication and gain direct access to the application...

phpList < 3.5.5 Multiple Vulnerabilities

phpList is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phplist:phplist"; if description...

PT-2020-15427 · Jenkins · Jenkins Github Coverage Reporter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitHub Coverage Reporter Plugin versions 1.8 and earlier Jenkins GitHub Coverage Reporter Plugin versions 1.10 and earlier Description: The issue concerns the storage of secrets in plain text in the global configuration file on the...

DEBIAN-CVE-2020-14196

In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2020-36772)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 5.0.0 through 5.0.1. An attacker can exploi...

Security Bulletin: IBM TNPM for Wireline is vulnarable to Cross Site Request Forgery(CSRF) and Cross Site Scripting(CSS)

Summary IBM TNPM for Wireline is vulnarable to Cross Site Request ForgeryCSRF and Cross Site ScriptingCSS . This has been addressed. Vulnerability Details Third Party Entry: PSIRT-ADV0016782 DESCRIPTION: CVSS Base score: 5.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Third Party...

PT-2020-14431 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax php pecl.php...

PT-2020-14082 · Global Radar · Global Radar Bsa Radar

Name of the Vulnerable Software and Affected Versions: Global RADAR BSA Radar versions 1.6.7234.24750 and earlier Description: The issue allows users to view local files on the web server by manipulating the FileName and FilePath parameters in the URL, or while using a proxy, potentially exposing...

PT-2020-14070 · Squirrelmail · Squirrelmail

Name of the Vulnerable Software and Affected Versions: SquirrelMail version 1.4.22 Description: The issue arises in compose.php, where the $attachments value from an HTTP POST request is passed to unserialize. This could potentially lead to PHP object injection. However, the vendor disputes this,...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI (CVE-2020-4362)

Summary Websphere Application Server WAS is shipped as a component of Tivoli Netcool/OMNIbus WebGUI. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

NeonLMS Learning Management System PHP Laravel Script 4.6 XSS Vulnerability

NeonLMS Learning Management System PHP Laravel Script version 4.6 suffers from a persistent cross site scripting vulnerability. Exploit Title: NeonLMS - Learning Management System PHP Laravel Script - 'Messages' Persistent Cross Site Scripting Exploit Author: th3d1gger Vendor Homepage:...

Huawei Data Communication: Two Vulnerabilities of License Module in Some Huawei Products (huawei-sa-20171206-01-license)

There is a uncontrolled format string vulnerability when the license module of some Huawei products output the log information. This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced...

Mozilla Firefox ESR Security Advisories (MFSA2020-20, MFSA2020-21) - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Google Chrome Security Bypass Vulnerability (CNVD-2020-29308)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome prior to version 83.0.4103.61, which stems from the program failing to adequately validate user-submitted input. A remote attacker could exploit the vulnerability to bypass security...