Vulnerabilities fixed in GitLab

Several vulnerabilities have been fixed in GitLab. The vulnerabilities potentially allow a malicious person to launch attacks execute attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS Denial-of-Service DoS. Manipulation of data...

CVE-2020-4647

IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database...

IBM Sterling File Gateway SQL Injection Vulnerability (CNVD-2020-63940)

IBM Sterling File Gateway is a centralized management gateway product for file transfers from IBM USA. IBM Sterling File Gateway suffers from a SQL injection vulnerability that can be exploited by an attacker to send specially written SQL statements that allow the attacker to view, add, modify, o...

Vulnerabilities fixed in Schneider Electric products

Schneider Electric has fixed vulnerabilities in several ICS and SCADA products. The vulnerabilities allow a malicious potentially able to launch attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS Denial-of-Service DoS. Data...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed multiple vulnerabilities in several developer tools. A malicious party could potentially exploit them to execute arbitrary code with both user privileges as well as elevated privileges or manipulate data. Vulnerabilities related to Visual Studio can only be be exploited by...

Vulnerability of the MySQL Server component: The DML mechanism of the MySQL Database Management System allows attackers to gain full control over the application.

The vulnerability of the MySQL Server component relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain full control over the application using the MySQL protocol...

Vulnerabilities identified in GNU/Linux subsystem of Siemens SIMATIC S7-1500 CPU

Vulnerabilities have been identified in the GNU/Linux subsystem of Siemens SIMATIC S7-1500 CPU. The vulnerabilities allow a malicious person able to perform attacks leading to the following categories of damage: Denial-of-Service DoS. Manipulation of data Circumvention of security measure Remote...

Huawei EulerOS: Security Advisory for cryptsetup (EulerOS-SA-2020-2409)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerability fixed in Red Hat Jboss Enterprise Application Platform

A vulnerability has been fixed in Red Hat Jboss Enterprise Application Platform. The vulnerability allows a remote malicious person to remotely able to manipulate data and thereby cause a Denial-of-Service. Red Hat has released updates to fix the vulnerability in. More information can be found on...

Lot Reservation Management System 1.0 Cross Site Scripting

Exploit Title: lot reservation management system 1.0 - Stored Cross Site Scripting Date: 2020-10-22 Exploit Author: Ankita Pal Vendor Homepage: https://www.sourcecodester.com/php/14530/lot-reservation-management-system-using-phpmysqli-source-code.html Software Link:...

Vulnerabilities fixed in Oracle Communications-producton

Oracle has fixed vulnerabilities in Communications Messaging Server. The vulnerabilities allow an unauthenticated malicious person with network access to the vulnerable system may be able to launch attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS...

Unspecified Vulnerability in Oracle Java SE and Oracle Java SE Embedded (CNVD-2020-61049)

Oracle Java SE and Oracle Java SE Embedded are both products of Oracle Corporation.Oracle Java SE is a Java platform for developing and deploying Java applications for desktops, servers, and embedded devices and real-time environments.Oracle Java SE Embedded is a Java platform that targets Java...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2020-58244)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: DML component of Oracle MySQL Server 8.0.21 and earlier versions. An attacker could exploit this...

Vulnerabilities fixed in Oracle Financial Services Software

Oracle has fixed vulnerabilities in several Oracle Financial Services products. The vulnerabilities enable an unauthenticated malicious person with network access to a vulnerable system potentially able to launch attacks that result in the following categories of damage: Denial-of-Service DoS...

Vulnerabilities fixed in Cisco ASA and FTD

Vulnerabilities have been fixed in Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD. The vulnerabilities allow a malicious party to conduct attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS...

CVE-2020-14831

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite component: Marketing Administration. Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2020-14780

Vulnerability in the BI Publisher product of Oracle Fusion Middleware component: BI Publisher Security. Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2020-14782

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multipl...

Design/Logic Flaw

Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromis...

CVE-2020-14801

CVE-2020-14801 affects Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology) with affected versions 8.56–8.58. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, requiring user interaction, potentially leadin...