CVE-2021-2360

Vulnerability in the Oracle Approvals Management product of Oracle E-Business Suite component: AME Page rendering. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Approvals...

CVE-2021-2360

CVE-2021-2360 affects Oracle E-Business Suite AME Page rendering in versions 12.1.1–12.1.3. A low-privilege, unauthenticated attacker with network access via HTTP can compromise Oracle Approvals Management, leading to unauthorized creation/deletion/modification of data and access to all AME data....

CVE-2021-2360

Vulnerability in the Oracle Approvals Management product of Oracle E-Business Suite component: AME Page rendering. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Approvals...

CVE-2021-2360

Vulnerability in the Oracle Approvals Management product of Oracle E-Business Suite component: AME Page rendering. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Approvals...

Oracle E-Business Suite 输入验证错误漏洞

Oracle E-Business Suite is an extension of the original Application ERP and includes a collection of ERP Enterprise Resource Planning Management, HR Human Resource Management, CRM Customer Relationship Management, and other applications that are seamlessly integrated into one management suite...

CVE-2021-21675

A cross-site request forgery CSRF vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administrators apply pending requests...

Malicious Package

Overview paychex-framework-approvals is a malicious package. It uses a preinstall script to steal environment variables. Remediation Avoid using all malicious instances of the paychex-framework-approvals package. Credit: Snyk Research...

CVE-2020-23960

Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to 1 approve the mass of the user's comments, 2 restoring a deleted user, 3 installing or running modules, 4 resetting the...

Gitlab -- multiple vulnerabilities

Gitlab reports: SSRF GCP access token disclosure Persistent XSS on issue details Diff formatter DoS in Sidekiq jobs Confidential information disclosure in events API endpoint validatelocalhost function in urlblocker.rb could be bypassed Slack integration CSRF Oauth2 GRPC::Unknown logging token...

GitLab: XSS in request approvals

Hello, team! I found xss. Steps to reproduce: 1. Open project settings 2. paste in this field link777 F339770 3. click on result F339772 In the username, a XSS poc should be written, like mine. Impact XSS...

GitLab: Persistent XSS - Selecting users as allowed merge request approvers

Summary: When using the dropdown that selects the users that are allowed to approve a merge request, it is possible to trigger a XSS with a malicious user name string. Description: This vulnerability is similar to the recently announced CVE-2018-10379 and another vulnerability I recently reported...

Instagram Adds Two-Factor Authentication

Instagram became the latest in a long line of services over the years to offer users two-factor authentication this week. Kevin Systrom, co-founder and CEO of the Facebook-owned mobile photo-sharing app announced the feature on its blog Thursday afternoon. With the feature – accessible via Settin...

Unspecified Vulnerability in Oracle E-Business Suite Oracle Approvals Management AME Page rendering Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. An unspecified security vulnerability exists in the Oracle Approvals Management AME Page rendering component within Oracle E-Business Suite, which could be exploited by remote attackers to submit a special request for...

CVE-2016-0581

Unspecified vulnerability in the Oracle Approvals Management component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to AME Page rendering...

CVE-2016-0581

CVE-2016-0581 concerns an unspecified vulnerability in the Oracle Approvals Management (AME) Page rendering component of Oracle E-Business Suite 11.5.10.2 . The vulnerability allows remote attackers to affect confidentiality and integrity via vectors related to the AME Page rendering. The descrip...

Facebook to Notify Users of Targeted Attacks

Facebook will inform users when it believes their account is being either being targeted by an attacker, or has been compromised by a nation-state campaign. Alex Stamos, Facebook’s Chief Security Officer, announced the initiative in a post on Facebook’s Security page late Friday afternoon. Users...

Facebook Will Now Notify You If NSA is Spying on You

Facebook just launched a new notification feature that will alert you if the social network strongly suspects that your account is being hijacked or targeted by hackers working in the interest of a nation-state. The message, which you can see below, recommends users to turn ON "Login Approvals," ...

CVE-2013-3525

SQL injection vulnerability in Approvals/ in Request Tracker RT 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted...

UBUNTU-CVE-2013-3525

DISPUTED SQL injection vulnerability in Approvals/ in Request Tracker RT 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it...

CVE-2013-3525

CVE-2013-3525 affects Request Tracker (RT) versions 4.0.10 and earlier in the Approvals/ section, where a SQL injection via the ShowPending parameter could allow remote command execution. The issue is consistently described across sources as a SQL injection vulnerability; the vendor disputes repl...