CVE-2020-3224

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to an affected device. The injected commands should require a higher privilege level in order to be executed. The...

CVE-2020-3224 Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to an affected device. The injected commands should require a higher privilege level in order to be executed. The...

CVE-2020-3224 Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to an affected device. The injected commands should require a higher privilege level in order to be executed. The...

CVE-2020-13379

An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer...

Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to an affected device. The injected commands should require a higher privilege level in order to be executed. The...

CVE-2020-13379

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network th...

CVE-2020-10719

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling...

varnish: denial of service handling certain crafted HTTP/1 requests

A flaw was found in the way Varnish parsed certain HTTP/1 requests. A remote attacker could use this flaw to crash Varnish by sending specially crafted multiple HTTP/1 requests processed on the same HTTP/1 keep-alive connection. This causes Varnish to restart with a clean cache, causing a denial ...

The vulnerability of the User Interface sub-component of the Oracle Financial Services Balance Sheet Planning component in the bank analytics system’s simulation model allows a perpetrator to create, delete, or modify access rights to protected information, or gain read-only access to data.

The vulnerability of the User Interface sub-component of the Oracle Financial Services Balance Sheet Planning banking analytics system’s simulation model relates to the lack of protection for operational data. Exploiting this vulnerability allows an attacker to create, delete, or modify access...

EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-1591)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to acce...

CVE-2020-6091

An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303. A specially crafted series of HTTP requests can cause authentication bypass resulting in information disclosure. An attacker can send an...

CVE-2020-6091

An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303. A specially crafted series of HTTP requests can cause authentication bypass resulting in information disclosure. An attacker can send an...

Epson EB-1470Ui ESPON Web Control Authentication Bypass Vulnerability

Summary An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303. A specially crafted series of HTTP requests can cause authentication bypass resulting in information disclosure. An attacker can...

Securing GraphQL API

Introduction to GraphQL Representational state transfer REST APIs are the most popular type of API. However, GraphQL is rapidly growing in popularity as a competitor to REST. GraphQL is a meta-layer with built-in query language to access object-oriented data. It’s based on JSON-encoded HTTP...

IBM Sterling B2B Integrator Information Disclosure Vulnerability (CNVD-2020-30842)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An information disclosure vulnerability exists in IBM Sterlin...

The vulnerability of the OTA Training Activities sub-component of the Oracle Learning Management component in the Oracle E-Business Suite system allows a malicious user to gain access to and modify data.

The vulnerability of the OTA Training Activities sub-component of the Oracle Learning Management component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to gain access to read, modify, add, or delete data...

The vulnerability of the Miscellaneous sub-component of the Oracle Scripting component in the Oracle E-Business Suite allows a perpetrator to gain access to and modify data.

The vulnerability of the Miscellaneous sub-component of the Oracle Scripting component in the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to read, modify, add, or delete data...

Cisco Data Center Network Manager SQL Injection (CVE-2019-15984)

An SQL injection vulnerability exists in Cisco Data Center Network Manager. The vulnerability is due to insufficient input validation when processing HTTP requests in the Java class smartLicensingController...

CVE-2020-10719

A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling...

CVE-2020-5562

Server-side request forgery SSRF vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function...