CVE-2020-25385

Nagios Log Server 2.1.7 contains a cross-site scripting XSS vulnerability in /nagioslogserver/configure/createsnapshot through the snapshotname parameter, which may impact users who open a maliciously crafted link or third-party web page...

CVE-2021-2054: Undefined Security Weakness

Vulnerability in the RDBMS Sharding component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure, Create Any View, Create Any Trigger privilege with network access...

CVE-2021-2045: Undefined Security Weakness

Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle...

CVE-2021-1993: Undefined Security Weakness

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM...

PT-2021-11132

Name of the Vulnerable Software and Affected Versions: Nagios Log Server version 2.1.7 Description: The issue is a cross-site scripting XSS vulnerability. It is located in the /nagioslogserver/configure/create snapshot API endpoint through the snapshot name parameter. This may impact users who op...

PT-2021-1794

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, and 19c Description: The issue is related to insufficient input validation in the Oracle Text component of Oracle Database Server. It allows a low-privileged attacker with Create Sessio...

PT-2021-1766

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 12.2.0.1, 18c, 19c Description: The issue is related to the RDBMS Sharding component of Oracle Database Server, where an easily exploitable vulnerability allows a high-privileged attacker with network access vi...

PT-2021-1882

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c and 19c Description The issue is related to the Java VM component and is associated with inadequate access control. It allows a low-privileged attacker with Create Session privilege and...

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

RHEL 8 : postgresql:12 (RHSA-2021:0163)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0163 advisory. PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream...

The vulnerability of the nsm DropPrivileges function (from the support/nsm.File.c module in the NFS utilities nfs-utils package) arises from improper assignment of standard privileges. This allows attackers to gain access to confidential data and compromise its integrity.

The vulnerability of the nsm DropPrivileges function from the NFS utility package nfs-utils, file.c section is related to the improper assignment of standard privileges. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential data, compromise its...

CVE-2021-0317

In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-10...

CVE-2020-26045

FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

CVE-2020-26045: Improper Neutralization of Special Elements used in an SQL Command

FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

FUEL CMS SQL注入漏洞

FUEL CMS is a content management system based on CodeIgniter. FUEL CMS 1.4.11 suffers from a SQL injection vulnerability. The vulnerability can be exploited by an attacker via the 'name' parameter in /fuel/permissions/create/ to compromise an application, access or modify data, or exploit a...

PT-2021-11207

Name of the Vulnerable Software and Affected Versions: FUEL CMS version 1.4.11 Description: The issue allows SQL Injection via the name parameter in the "/fuel/permissions/create/" endpoint. This could enable an attacker to compromise the application, access or modify data, or exploit latent...

Rust Security Vulnerabilities

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in rusqlite crate before 0.23.0 for Rust, which stems from the ability to violate memory safety via the create module...

PT-2020-17416

Name of the Vulnerable Software and Affected Versions site-offline plugin versions prior to 1.4.4 for WordPress Description The issue is related to the lack of certain wp create nonce and wp verify nonce calls, which can lead to CSRF. Recommendations For versions prior to 1.4.4, update to version...

Zammad Account Enumeration Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An account enumeration vulnerability exists in Zammad versions prior to 3.4.1. The vulnerability can be exploited to guess valid user e-mail addresses via the "Create User" feature...

CVE-2020-26034

An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as...