Oracle Java SE Access Control Error Vulnerability (CNVD-2019-26747)

Oracle Java SE is a U.S. Oracle Oracle company for the development and deployment of desktop, server and embedded devices and real-time environments in the Java application. An access control error vulnerability exists in the Security subcomponent of Oracle Java SE versions 7u221, 8u212, and...

Unspecified Vulnerability in GitLab (CNVD-2020-22023)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

PT-2019-9860 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: Gitlab CE/EE versions 8.6 up to 11.3.10 Gitlab CE/EE versions 11.4 up to 11.4.7 Gitlab CE/EE versions 11.5 up to 11.5.0 Description: The issue concerns an incorrect access control vulnerability. This vulnerability can display the title and...

PT-2019-4891 · Xen +1 · Xen +1

Name of the Vulnerable Software and Affected Versions: Xen versions prior to 4.11.x Description: The issue is caused by synchronization errors when using a shared resource, allowing an attacker to cause a denial of service or gain privileges by leveraging a page-writability race condition during...

CVE-2019-13475

In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute...

Odoo Information Disclosure Vulnerability

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language with PostgreSQL as database and includes modules for sales management, inventory management, financial management and so on. An information...

Odoo Access Control Error Vulnerability (CNVD-2019-30600)

Odoo is an enterprise resource planning ERP and customer relationship management CRM system from Odoo Belgium. The system is developed in Python language, PostgreSQL as the database, and includes modules for sales management, inventory management, financial management and so on. An Access Control...

Odoo Access Control Error Vulnerability (CNVD-2019-30572)

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language with PostgreSQL as database and includes modules for sales management, inventory management, financial management and so on. An access control...

Odoo Permission License and Access Control Issues Vulnerability (CNVD-2019-30603)

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language, PostgreSQL as the database, and includes modules for sales management, inventory management, financial management and so on. A...

Odoo Permission License and Access Control Issues Vulnerability (CNVD-2019-30573)

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language with PostgreSQL as database and includes modules for sales management, inventory management, financial management and so on. A permission and...

GitLab (Community and Enterprise Edition) Denial of Service Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

CVE-2018-14733

The Odoo Community Association OCA dbfilterfromheader module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS regular expression denial of service under certain circumstances...

CVE-2018-14860

Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system...

CVE-2018-14859

Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token...

CVE-2018-14861

Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed passwords of other users...

CVE-2018-14862

Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request...

CVE-2018-14865

Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files...

CVE-2018-14866

Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs...

Niushop B2B2C Multi-merchant Mall System Exploits Arbitrary Password Reset Vulnerability

NiuShop B2B2C Multi-Merchant Mall System is a PHP open source e-commerce system designed and developed completely independently by Shanxi NiuKu Information Technology Co. Niushop B2B2C Multi-merchant Mall System V1.11 version of the arbitrary password reset vulnerability, an attacker can use the...

IBM Robotic Process Automation with Automation Anywhere Information Disclosure Vulnerability (CNVD-2019-20993)

IBM Robotic Process Automation with Automation Anywhere is a suite of process automation solutions from IBM USA. An information disclosure vulnerability exists in IBM Robotic Process Automation with Automation Anywhere version 11.0. An attacker could exploit this vulnerability to obtain email...