QRadar Community Edition 7.3.1.6 Server Side Request Forgery Vulnerability

QRadar Community Edition version 7.3.1.6 has an issue where the RssFeedItem class of the QRadar web application is used to fetch and parse RSS feeds. No validation is performed on the user-supplied RSS feed URL. Due to the lack of URL validation whitelisting, it is possible for authenticated...

QRadar Community Edition 7.3.1.6 CSRF / Weak Access Control Vulnerability

QRadar Community Edition version 7.3.1.6 suffers from cross site request forgery and weak access control vulnerabilities. ------------------------------------------------------------------------ Cross-Site Request Forgery & weak access control in QRadar ConfigServices webservice...

QRadar Community Edition 7.3.1.6 Path Traversal Vulnerability

QRadar Community Edition version 7.3.1.6 has a path traversal that exists in the session validation functionality. In particular, the vulnerability is present in the part that handles session tokens UUIDs. QRadar fails to validate if the user-supplied token is in the correct format. Using path...

QRadar Community Edition 7.3.1.6 Cross Site Scripting Vulnerability

QRadar Community Edition version 7.3.1.6 suffers from a reflective cross site scripting vulnerability in the Forensics link analysis page. ------------------------------------------------------------------------ Reflected Cross-Site Scripting in QRadar Forensics link analysis page...

QRadar Community Edition 7.3.1.6 Arbitrary Object Instantiation Vulnerability

QRadar Community Edition version 7.3.1.6 is vulnerable to instantiation of arbitrary objects based on user-supplied input. An authenticated attacker can abuse this to perform various types of attacks including server-side request forgery and potentially arbitrary execution of code...

CVE-2020-11505

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure Exposure of Sensitive Information via request smuggling...

Design/Logic Flaw

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure Exposure of Sensitive Information via request smuggling...

CVE-2020-11505

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure Exposure of Sensitive Information via request smuggling...

SQL Injection Vulnerability in Heybbs Micro Community ad***.php File

Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. A SQL injection vulnerability exists in the Heybbs Micro Community ad.php file. Attackers can use the vulnerability to obtain sensitive information in the database...

PT-2020-12652 · Microsoft +1 · Nuget +2

Name of the Vulnerable Software and Affected Versions: GitLab Community Edition CE versions 12.7.x through 12.7.8 GitLab Community Edition CE versions 12.8.x through 12.8.8 GitLab Community Edition CE versions 12.9.x through 12.9.2 GitLab Enterprise Edition EE versions 12.7.x through 12.7.8 GitLa...

Heybbs Micro Community lo***.php file has SQL injection vulnerability

Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. There is a SQL injection vulnerability in the Heybbs micro community lo.php file. Attackers can use the vulnerability to obtain sensitive information in the database...

Heybbs Micro Community in***.php file has a reload vulnerability

Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. Heybbs micro-community in.php file exists reloading vulnerability. An attacker can use the vulnerability to reset all the data on the website and gain server privilege...

QRadar Community Edition 7.3.1.6 CSRF / Weak Access Control

------------------------------------------------------------------------ Cross-Site Request Forgery & weak access control in QRadar ConfigServices webservice ------------------------------------------------------------------------ Yorick Koster, September 2019...

QRadar Community Edition 7.3.1.6 Cross Site Scripting

------------------------------------------------------------------------ Reflected Cross-Site Scripting in QRadar Forensics link analysis page ------------------------------------------------------------------------ Yorick Koster, September 2019...

QRadar Community Edition 7.3.1.6 Path Traversal

------------------------------------------------------------------------ QRadar session manager path traversal vulnerability ------------------------------------------------------------------------ Yorick Koster, September 2019...

Oracle PeopleSoft Products PeopleSoft Enterprise CS Campus Community Unauthorized Access Vulnerability

Oracle PeopleSoft Products is a set of enterprise human capital management solutions from Oracle Oracle. The product provides human capital management, financial management, supplier relationship management and other functions. A security vulnerability exists in the Self-Service component of...

CVE-2020-2912

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft component: Self-Service. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS...

CVE-2020-2912

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft component: Self-Service. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS...

CVE-2020-2912

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft component: Self-Service. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS...

CVE-2020-2912

Vulnerability CVE-2020-2912 affects Oracle PeopleSoft Enterprise CS Campus Community, specifically the Self-Service component in PeopleSoft 9.2. The issue allows a low-privilege attacker with network access over HTTP to read confidential data from the Self-Service area, with the vulnerability des...