DEBIAN-CVE-2020-8225

A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials...

CVE-2020-8225

A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials...

CVE-2020-8225

A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials...

Security Bulletin: IBM Kenexa LCMS Premier On Premise - [All] jQuery (Publicly disclosed vulnerability) CVE-2020-11023, CVE-2020-11022

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details CVEID: CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper...

Remote Code Execution

activemq-broker is vulnerable to remote code execution. A regression that prevents JMX re-bind allows an attacker to execute arbitrary code by passing an empty environment map to MIConnectorServer instead of the map that contains the authentication credentials...

PT-2020-7217

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Guardium versions 7.0 through 8.2 Description The issue is caused by improper validation of user-supplied input, leading to cross-site scripting. A remote attacker could exploit this using a specially-crafted URL to execute scri...

CVE-2012-2160

IBM Rational Change 5.3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the SUPPTEMPLATEFLAG parameter in a specially-crafted URL to execute script in a victim's Web browser within the security...

Updated targetcli packages fix security vulnerability

An access flaw was found in targetcli, where the /etc/target and underneath backup directory/files were world-readable. This flaw allows a local attacker to access potentially sensitive information such as authentication credentials from the /etc/target/saveconfig.json and backup files. The highe...

Security Bulletin: A vulnerability in the GSKit component of IBM Sterling Connect:Direct for Microsoft Windows (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM Sterling Connect:Direct for Microsoft Windows. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by an MD5 collision. An attacker could...

Security Bulletin: Multiple Eclipse Jetty Vulnerabilities Affect IBM Sterling Secure Proxy Summary

Summary Three Eclipse Jetty vulnerabilities were addressed by IBM Sterling Secure Proxy. Vulnerability Details CVE-ID: CVE-2019-10241 Description: Eclipse Jetty is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the DefaultServlet and ResourceHandler. A...

Security Bulletin: Apache CXF XSS Vulnerability Affects IBM Control Center (CVE-2019-17573)

Summary Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the services listing page. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of...

Privilege escalation from compromised node to cluster

CVSS Rating: Medium 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H If an attacker is able to intercept certain requests to the Kubelet, they can send a redirect response that may be followed by a client using the credentials from the original request. This can lead to compromise of other nodes...

CVE-2017-1659

"HCL iNotes is susceptible to a Cross-Site Scripting XSS Vulnerability. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials."...

Cross site scripting

"HCL iNotes is susceptible to a Cross-Site Scripting XSS Vulnerability. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials."...

CVE-2018-21248

An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials...

CVE-2018-21248

An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials...

CVE-2018-21248

Mattermost Server prior to 5.4.0 is affected by an issue that mishandles possession of superfluous authentication credentials. The CVSS-3.1 base score is 7.5 (HIGH) with NETWORK attack vector, no privileges required, and HIGH impact on confidentiality (I: HIGH, C: HIGH) per the advisory. Root cau...

CVE-2018-21248

An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials...

PT-2020-8891

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.4.0 Description The issue concerns the mishandling of possession of superfluous authentication credentials. Recommendations For versions prior to 5.4.0, update to version 5.4.0 or later to resolve the issu...