Xen Denial of Service Vulnerability (CNVD-2020-25871)

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in Xen 4.13....

Envoy and Istio Information Disclosure Vulnerabilities

Envoy is an open source distributed proxy server.Istio is an open platform for connecting, managing and securing microservices. An information disclosure vulnerability exists in Istio 1.5.1 and earlier versions and Envoy 1.14.1 and earlier versions. An attacker can exploit the vulnerability to...

CVE-2020-7800

The Synergy Systems & Solutions SSS HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Improper Check for Unusual or Exceptional Conditions CWE-754 vulnerability. The affected product is vulnerable to specially crafted TCP packets, which can cause the device to shut down or reboot a...

Vastgota-Data ProVide Injection Vulnerability

Vastgota-Data ProVide is a file transfer server with a graphical user interface from Vastgota-Data, Sweden. An injection vulnerability exists in /ajax/GetInheritedProperties in Vastgota-Data ProVide 13.1 and earlier versions. The vulnerability arises from a lack of proper validation of user input...

Vastgota-Data ProVide Admin Web Interface Cross-Site Scripting Vulnerability

Vastgota-Data ProVide is a file transfer server with a graphical user interface from Vastgota-Data, Sweden. A cross-site scripting vulnerability exists in the Admin Web Interface in Vastgota-Data ProVide 13.1 and earlier versions. The vulnerability stems from a lack of proper validation of client...

WordPress WP Lead Plus X Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.WP Lead Plus X is a page builder that supports building login and other pages. A cross-site scripting vulnerability exists i...

WordPress Rank Math Input Validation Error Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Rank Math is a search engine optimization SEO plugin used in it. An input validation error vulnerability exists in WordPress Rank Math...

npm package utils-extend input validation error vulnerability

npm package utils-extend is a lightweight package for extending Node.js utilities. An input validation error vulnerability exists in npm package utils-extend 1.0.8 and earlier versions. A remote attacker can exploit this vulnerability to execute code or cause a denial of service...

apiconnect-cli-plugins Command Injection Vulnerability

apiconnect-cli-plugins is a development kit plugin for IBM API Connect. An injection vulnerability exists in apiconnect-cli-plugins version 6.0.1 and earlier. An attacker can exploit this vulnerability to execute arbitrary commands with the help of the 'pluginUri' parameter...

Ini-parser Resource Management Error Vulnerability

Ini-parser is a parser for .ini format files. A resource management error vulnerability exists in ini-parser 0.0.2 and earlier versions. An attacker can exploit this vulnerability to add or modify properties of Object.prototype to execute arbitrary code...

CVE-2020-7620

pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params...

Phoenix Contact PC WORX SRT Elevation of Privilege Vulnerability

Phoenix Contact PC WORX SRT is a programmable logic controller from Phoenix Contact, Germany. A security vulnerability exists in Phoenix Contact PC WORX SRT version 1.14 and earlier, which stems from insecure default path privileges. An attacker can exploit the vulnerability to elevate privileges...

Phoenix Contact PORTICO SERVER Elevation of Privilege Vulnerability

Phoenix Contact PORTICO SERVER is a set of remote control software from Phoenix Contact, Germany. A security vulnerability exists in Phoenix Contact PORTICO SERVER 3.0.7 and earlier versions. The vulnerability can be exploited by an attacker to gain administrator privileges...

Azkaban Code Issues Vulnerabilities

Azkaban is a batch workflow job scheduler for running Hadoop jobs. A code issue vulnerability exists in Azkaban 3.84.0 and prior versions. The vulnerability stems from an improperly designed or implemented code development process for a networked system or product. No detailed vulnerability detai...

CVE-2020-5129

A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which leads to Denial of Service. This vulnerability affected SMA1000 Version 12.1.0-06411 and earlier...

CVE-2020-3790

Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution...

Double free

Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and earlier have a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution...

Cross site request forgery (csrf)

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL...

CVE-2020-6978

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries...

ONAP Logging Access Control Error Vulnerability

ONAP Logging is a logger in the ONAP network management system from the ONAP project. An access control error vulnerability exists in ONAP Logging Dublin and previous versions. An attacker can exploit this vulnerability to gain full privileges to the ONAP service without authentication via ports...