CVE-2020-35614

Joomla! is affected from 3.9.0 through 3.9.22 by a backend login user enumeration vulnerability caused by improper handling of the username. The issue enables an attacker to infer valid usernames via the backend login page. Remediation per linked sources is to update Joomla! to a version that fix...

CVE-2020-35613 [20201104] - Core - SQL injection in com_users list view

An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user list...

Joomla SQL注入漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A SQL injection vulnerability exists in the back-end user list of Joomla! 3.0.0 -...

Hedgedoc 代码问题漏洞

Hedgedoc is a Javascript-based Markdown document real-time editing and sharing platform by the Hedgedoc team. A file upload vulnerability exists in versions prior to HedgeDoc 1.7.1, which can be exploited by an unauthenticated attacker to upload arbitrary files to the upload storage backend,...

PT-2020-17366 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.9.0 through 3.9.22 Description: An issue was discovered that leads to a user enumeration attack vector in the backend login page due to improper handling of the username. Recommendations: For Joomla! versions 3.9.0 through...

PT-2020-17365 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.22 Description: An issue was discovered that leads to a SQL injection vulnerability in the backend user list due to improper filter blacklist configuration. Recommendations: For Joomla! versions 3.0.0 throug...

Weak Password Vulnerability in the Backend of NetSense SecBMS 3600 Bandwidth Management System

NetShen Information Technology Beijing Co., Ltd. specializes in network and information security. A weak password vulnerability exists in the backend of NetShen SecBMS 3600 Bandwidth Management System, which can be exploited by an attacker to log in to the system with a weak password and perform...

Logrhythm Platform Manager Access Control Error Vulnerability

Logrhythm Platform Manager is a component of the Logrhythm application from Logrhythm USA. The component is responsible for centralized management of alerts, notifications and case and security event management. Supports real-time dashboards, SmartResponse operations and reports. An Access Contro...

CVE-2020-26275

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a...

An issue was discovered in the Linux kernel through 5.10.1 as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.

...

File Upload Vulnerability in ClassCMS Backend

ClassCMS is a content management system. A file upload vulnerability exists in the ClassCMS backend. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

CVE-2020-25096

LogRhythm Platform Manager PM 7.4.9 has Incorrect Access Control. Users within LogRhythm can be delegated different roles and privileges, intended to limit what data and services they can interact with. However, no access control is enforced for WebSocket-based communication to the PM application...

CVE-2020-25096

LogRhythm Platform Manager PM 7.4.9 has Incorrect Access Control. Users within LogRhythm can be delegated different roles and privileges, intended to limit what data and services they can interact with. However, no access control is enforced for WebSocket-based communication to the PM application...

Sonatype Nexus Repository Manager External Entity Injection Vulnerability

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. An external entity injection vulnerability exists in the Sonatype Nexus Repository Manager product, which allows an attacker with Nexus Repository Manager administrator privileges to configure the system in su...

F5 Networks BIG-IP : BIG-IP ASM vulnerability (K58102101)

When the BIG-IP ASM system processes requests with JSON payload, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. CVE-2020-27718 Impact When this vulnerability is exploited, the BIG-IP ASM system may take longer than usual to process these...

Sonatype Nexus Repository Manager 代码问题漏洞

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. An external entity injection vulnerability exists in the Sonatype Nexus Repository Manager product, which allows an attacker with Nexus Repository Manager administrator privileges to configure the system in su...

mkCMS v6.2.6 SQL Injection Vulnerability in Backend

mkCMS is a free and open source PHP content management system, small yet powerful, with tons of templates and more. mkCMS v6.2.6 has a SQL injection vulnerability in the background, which can be exploited by attackers to obtain sensitive information from the database...

ALPINE-CVE-2020-29568

An issue was discovered in Xen through 4.14.x. Some OSes such as Linux, FreeBSD, and NetBSD are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OO...

DEBIAN-CVE-2020-29569

An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring-xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the...

CVE-2020-29569

An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring-xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the...