Unspecified Vulnerability in Oracle Fusion Middleware Reports Developer

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle USA. The platform provides middleware, software collection and other functions. An unspecified vulnerability exists in Oracle Fusion Middleware Reports...

PT-2020-5321 · Php +7 · Php +7

Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x through 7.2.27 PHP versions 7.3.x through 7.3.14 PHP versions 7.4.x through 7.4.2 Description: The issue is related to the incorrect preservation of permissions when creating PHAR archives using the...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

PT-2020-5619 · Dojo +2 · Dojox +2

Name of the Vulnerable Software and Affected Versions: dojox versions prior to 1.16.1 dojox versions prior to 1.15.2 dojox versions prior to 1.14.5 dojox versions prior to 1.13.6 dojox versions prior to 1.12.7 dojox versions prior to 1.11.9 Description: The issue is related to the...

SoundCloud Tackles DoS, Account Takeover Issues

Online music platform SoundCloud, which can be thought of as an audio-based YouTube for music creators, has addressed several security bugs in its APIs that could lead to denial-of-service DoS or account takeover via credential-stuffing. SoundCloud recently sold a $75 million stake to satellite...

The vulnerability of the IP address filtering function in the Junos OS operating system allows attackers to compromise data integrity and violate data confidentiality.

The vulnerability of the IP address filtering function in the Junos OS operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise data integrity and violate data confidentiality...

The vulnerability of the autocmd function (window.c) in the Vim text editor allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the autocmd function window.c in the Vim text editor is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2020-5217

A flaw was found in rubygem-secureheaders in versions prior to 6.2.0, 5.1.0, and 3.8.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection which could be used to override a script-src directive. The...

CVE-2020-5398

A flaw was found in springframework in versions prior to 5.0.16, 5.1.13, and 5.2.3. A reflected file download RFD attack is possible when a "Content-Disposition" header is set in response to where the filename attribute is derived from user supplied input. The highest threat from this vulnerabili...

CVE-2020-7941

A privilege escalation flaw was found in plone in versions 4.3 through 5.2.1. Users are allowed to PUT overwrite some content without needing write permissions. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2020-7938

A flaw was found in Plone in versions 5.2.0 through 5.2.1. Users with a certain privilege level can escalate their privileges up to the highest privilege level when the site is using plone.restapi. The highest threat from this vulnerability is to data confidentiality and integrity as well as syst...

CVE-2019-4541

IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 165814...

CVE-2019-4541

IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 165814...

Input validation

IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 165814...

CVE-2019-4541

CVE-2019-4541 affects IBM Security Directory Server 6.4.0, where incomplete blocklisting for input validation allows bypassing application controls and impacts system integrity. The issue is tied to 6.4.0 and has remediation in the IBM bulletin: upgrade to 6.4.0.20-ISS-ISDS-IF0020 (or later) to a...

CVE-2019-4541

IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 165814...

kernel: heap overflow in marvell/mwifiex/tdls.c

A heap overflow flaw was found in the Linux kernel's Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If cod...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain access to data or compromise the integrity of the protected information.

The vulnerability of the Core component of the Oracle VM VirtualBox software lies in the lack of protection for service data. Exploiting this vulnerability can allow an attacker to gain access to data or compromise the integrity of the protected information...

CVE-2020-1719

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity...

The vulnerability of the SOAP API interface of the Cisco Data Center Network Manager system allows a perpetrator to gain unauthorized access to protected information, affect data integrity, or execute arbitrary commands on the underlying operating system.

The vulnerability of the REST API interface of the Cisco Data Center Network Manager DCNM system is related to input validation errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information, compromise data integrity, or...