The vulnerability in the web interface of the Cisco Jabber Guest software allows a attacker to execute arbitrary code in the context of the current user or disclose sensitive information.

The vulnerability in the Cisco Jabber Guest software’s web interface exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, or to disclose sensitive...

The vulnerability in the web interface of the Cisco Data Center Analytics Framework allows a perpetrator to execute arbitrary code in the context of the current user or disclose protected information.

The vulnerability in the web interface of the Cisco Data Center Analytics Framework exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, or to disclos...

The vulnerability in the web interface of the Cisco Crosswork Change Automation software allows a malicious actor to execute arbitrary code in the context of the current user or disclose protected information.

The vulnerability of the Cisco Crosswork Change Automation software’s web interface exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user or disclose sensitive...

The vulnerability of the Cisco AnyConnect Secure Mobility Client cryptographic protection mechanism is related to insufficient verification of data authenticity, which allows attackers to trigger service failures or disclose protected information.

The vulnerability of the Cisco AnyConnect Secure Mobility Client encryption method is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow attackers to cause service failures or expose the protected information...

The vulnerability in the web interface of the Cisco Email Security Appliance allows a perpetrator to execute arbitrary code in the context of the current user or disclose protected information.

The vulnerability in the web interface of the Cisco Email Security Appliance exists because measures to protect the structure of the web page have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, or to disclose...

CVE-2020-4292

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that should not be trusted which could disclose sensitive information. IBM X-Force ID: 176335...

CVE-2020-5539

GRANDIT Ver.1.6, Ver.2.0, Ver.2.1, Ver.2.2, Ver.2.3, and Ver.3.0 do not properly manage sessions, which allows remote attackers to impersonate an arbitrary user and then alter or disclose the information via unspecified vectors...

GRANDIT vulnerable to session management

Overview GRANDIT provided by GRANDIT CORPORATION contains a vulnerability in session management CWE-639. Kazuki Mitobe of FUJISOFT INCORPORATED reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A user who can...

HackerOne: Customer private program can disclose email any users through invited via username

Summary: Hey team,This bug could have been used by my calculations a long time ago Steps To Reproduce: 1Go to https://hackerone.com/hackeroneh1pbbp3/launch 2Take invite via username 3Input username , send invite 3.1When an invite is created, we get a token 4Now Go use GraphQL query...

The vulnerability of the Windows Cryptography Next Generation (CNG) service for Windows operating systems, which allows a hacker to compromise and disclose protected information

The vulnerability of the Windows Cryptography Next Generation CNG service on Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created application...

The vulnerability of the i2c_ddc functions in the QEMU hardware emulation software allows a hacker to disclose protected information.

The vulnerability of the i2cddc function hw/i2c/i2c-ddc.c in the QEMU hardware emulation software is related to reading data beyond the buffer limit 128 bytes of stack memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security...

The vulnerability of the PDFium PDF-content processor in Google Chrome browsers allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the PDFium PDF-content processor in the Google Chrome browser is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures through the use of a...

arrow:parquet-arrow-fuzz: Container-overflow in parquet::schema::Unflatten

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5110585828311040 Project: arrow Fuzzing Engine: afl Fuzz Target: parquet-arrow-fuzz Job Type: aflasanarrow Platform Id: linux Crash Type: Container-overflow READ 4 Crash Address: 0x61e0000840b0 Crash...

PT-2020-3261 · Apache +8 · Apache Http Server +8

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.0 through 2.4.41 Description: The issue is related to the mod rewrite function in the Apache HTTP Server, where redirects intended to be self-referential can be fooled by encoded newlines, causing them to...

ay263.infusionsoft.app Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1098286 Security Researcher tbm Helped patch 2172 vulnerabilities Received 6 Coordinated Disclosure badges Received 6 recommendations , a holder of 6 badges for responsible and coordinated disclosure, found a security vulnerability affecting ay263.infusionsoft.app website...

SOPlanning SQL Injection Vulnerability (CNVD-2020-10632)

SOPlanning is an online planning tool for efficiently organizing projects and tasks. An SQL injection vulnerability exists in the OrderBy clause in SOPlanning 1.45. An attacker can exploit this vulnerability to obtain information about a user's table via the projets.php?order=nomcreateur&by=...

CVE-2020-1736

A flaw was found in Ansible Engine when a file is moved using atomicmove primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions...

SQL injection vulnerability in Zendo Project Management Software co***.php file

Zendo Project Management Software is homegrown open source project management software. Zendo Project Management Software co.php file has a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

PT-2020-6878 · Abb +1 · Abb Esoms +1

Name of the Vulnerable Software and Affected Versions: ABB eSOMS versions 4.0 to 6.0.3 Description: The issue is related to the ASP.NET Viewstate component of the ABB eSOMS software, which lacks authentication for a critical function. This could allow a remote attacker to disclose protected...

The vulnerability of the DxgkDdiEscape function in the NVIDIA GeForce, Quadro, and Tesla graphics processor software, related to errors in synchronizing common data, allows attackers to cause system failures, increase their privileges, or disclose sensitive information.

The vulnerability of the DxgkDdiEscape function in the NVIDIA GeForce, Quadro, and Tesla graphics processing unit software is related to errors during the synchronization of common data. Exploiting this vulnerability can allow an attacker to cause system failures, increase their privileges, or...