CVE-2020-2043 PAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logs

An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for configuration logs and the sensitive field appears multiple tim...

CVE-2020-2043

CVE-2020-2043: PAN-OS information exposure in configuration logs when the after-change-detail custom syslog field is enabled. The first occurrence of the sensitive field is masked, but subsequent instances are exposed in clear text. Affected: PAN-OS 8.1.x before 8.1.16; 9.0.x before 9.0.10; 9.1.x...

PAN-OS: Passwords may be logged in clear text while storing operational command (op command) history

An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was introduced to track operational command op-command usage but...

CVE-2020-25004

Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...

CVE-2020-24949

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

Debian DLA-2337-1 : python2.7 security update

Multiple vulnerabilities were discovered in Python2.7, an interactive high-level object-oriented language. CVE-2018-20852 By using a malicious server an attacker might steal cookies that are meant for other domains. CVE-2019-5010 NULL pointer dereference using a specially crafted X509 certificate...

CVE-2020-16292

A buffer overflow vulnerability in mjrastercmd in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51...

Windows .LNK Execution Arbitrary Code

The vulnerability of Windows operating systems is related to errors in processing files with the extension .LNK. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially crafted .LNK file...

Security Update for Microsoft Word 2016 (KB4484474) 32-Bit Edition

A security vulnerability exists in Microsoft Word 2016 32-Bit Edition that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Heap overflow

DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution...

openSUSE Security Update : ant (openSUSE-2020-1022)

This update for ant fixes the following issues : - CVE-2020-1945: Fixed an inseure temorary file vulnerability which could have potentially leaked sensitive information bsc1171696. This update was imported from the SUSE:SLE-15-SP2:Update update project. C Tenable Network Security, Inc. The...

SUSE-SU-2020:1944-1 Security update for ant

This update for ant fixes the following issues: - CVE-2020-1945: Fixed an inseure temorary file vulnerability which could have potentially leaked sensitive information bsc1171696...

PT-2020-6992

Name of the Vulnerable Software and Affected Versions Python version 3.8.4 Description The issue is related to the python38. pth file, where sys.path restrictions are ignored, allowing code to be loaded from arbitrary locations. This could potentially enable a remote attacker to execute arbitrary...

procps-ng config_file Privilege Escalation

The vulnerability of the configfile function in the procps-ng command-line utility is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious individual to increase their privileges...

CVE-2020-1449

A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka 'Microsoft Project Remote Code Execution Vulnerability'...

S-CMS hospital website builder system aj***.php suffers from SQL injection vulnerability

S-CMS hospital station building system is developed by asp+access/mssql, easy to operate, convenient, support PC+mobile+WeChat. S-CMS hospital website builder system aj.php has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

SQL injection vulnerability in DouPHP sn***.php file at Zhangzhou Beanshell Network Technology Co.

DouPHP is a lightweight enterprise website management system based on PHP+Mysql architecture, running on various platforms such as Linux, Windows, MacOSX, Solaris and so on. A SQL injection vulnerability exists in the DouPHP sn.php file of Zhangzhou Beanshell Network Technology Co. Ltd, which can...

TuziCMS v3.0 Ma*** Mo***.cl***.php suffers from SQL injection vulnerability

TuziCMS is an enterprise website management system based on ThinkPHP 3.2 framework. TuziCMS v3.0 Ma Mo.cl.php suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Directory Traversal

Overview marscode is a web editor created with monaco-editor, jquery file tree and nodejs file tree to read, write, edit, delete CRUD files. Affected versions of this package are vulnerable to Directory Traversal. There is no path sanitization in the path provided at fs.readFile in index.js. PoC ...

CVE-2020-10750

Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials...