PT-2021-17755

Name of the Vulnerable Software and Affected Versions: Open5GS versions 2.1.3 through 2.2.x before 2.2.1 Description: A request-validation issue was discovered in the WebUI component, allowing an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in...

CVE-2021-28122: Missing Authentication for Critical Function

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. Th...

PT-2021-5138

Name of the Vulnerable Software and Affected Versions MasterCard, Visa, American Express affected versions not specified Apple Pay affected versions not specified Samsung Pay affected versions not specified GPay affected versions not specified Description The issue is related to insufficient...

HPESBUX04095 rev.1 - HP-UX Internet Express Software, Local Escalation of Privilege

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Internet Express System Software A.20.00-A.23.00 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-3156 |...

Open Redirect

Overview Slashify is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, bookings/latest/ to bookings/latest. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes or two backslashes, ...

GitHub Security Lab: [JavaScript]: add query for Express-HBS LFR

This bug was reported directly to GitHub Security Lab...

GHSA-F4HQ-453J-P95F Open redirect in Slashify

The package is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, bookings/latest/ to bookings/latest. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes or two backslashes, or a...

@glossgenius/eslint-config (>=1.0.2, <=1.0.7), @halonext/nestjs-express-cassandra (>=7.0.0, <=7.1.0) +7 more potentially affected by CVE-2021-26707 via merge-deep (>=3.0.0, <=3.0.2)

merge-deep NPM version =3.0.0, =1.0.2, =7.0.0, =5.2.0, =6.0.1, =0.0.1, =0.1.0-rc0, =0.0.11, =1.0.0, =1.2.4 Source cves: CVE-2021-26707 Source advisory: SNYK:JS-MERGEDEEP-1070277...

PT-2021-19565

Name of the Vulnerable Software and Affected Versions: slashify version 1.0.0 Description: The issue allows open-redirect attacks. It is an Express middleware that normalises routes by stripping any final slash and redirects without validating the path. For example, visiting a URL like...

The vulnerability of the Oracle Application Express Opportunity Tracker application, related to deficiencies in access control, allows an attacker to gain access to modify, add, or delete data.

The vulnerability of the Oracle Application Express Opportunity Tracker sales management application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access to modify, add, or delete data using the HTTP protocol...

UCOPIA Wi-Fi appliances code issue vulnerability

Ucopia Express is a device used to manage Wifi used by the French company Ucopia. A security vulnerability exists in Ucopia Express 6.0.5 that allows execution of arbitrary code with admin user privileges to exit restricted commands via escape...

Ucopia Express License Issues Vulnerability

Ucopia Express is a device used to manage Wifi used by the French company Ucopia. A security vulnerability exists in Ucopia Express 6.0.5 that allows the use of chroothole client PHP calls to execute arbitrary code with root privileges...

UCOPIA Wi-Fi appliances OS Command Injection Vulnerability

A security vulnerability exists in Ucopia Express 6.0.5 that allows an authenticated, remote attacker to escape the restricted administrative shell CLI and access a shell with admin user privileges via unprotected less commands...

The vulnerability of the Oracle Application Express Survey Builder component of the Oracle Database Server database management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the Oracle Application Express Survey Builder component of the Oracle Database Server database management system is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...

Security Bulletin: Multiple Oracle Database Server Vulnerabilities Affect IBM Emptoris Sourcing

Summary Multiple Oracle Database Server security vulnerabilities affect IBM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2020-14741 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Database Filesystem component could allow an authenticated attacker to caus...

Security Bulletin: Multiple Oracle Database Server Vulnerabilities Affect IBM Emptoris Contract Management

Summary Multiple Oracle Database Server security vulnerabilities affect IBM Emptoris Contract Management. Vulnerability Details CVEID: CVE-2020-14741 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Database Filesystem component could allow an authenticated...

CVE-2021-2116

Vulnerability in the Oracle Application Express Opportunity Tracker component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to...

CVE-2021-2117

Vulnerability in the Oracle Application Express Survey Builder component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromi...

Design/Logic Flaw

Vulnerability in the Oracle Application Express Opportunity Tracker component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to...

Design/Logic Flaw

Vulnerability in the Oracle Application Express Survey Builder component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromi...