Rust Code Injection Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust hyper crate before 0.12.34, which stems from the possibility of HTTP request smuggling. In some cases, remote code can be executed using an HTTP server on a loopback...

PT-2020-17372 · Mediawiki +1 · Mediawiki +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.35.1 Widgets extension for MediaWiki versions through 1.35.1 Description: An issue was discovered in the Widgets extension for MediaWiki, where any user with the ability to edit pages within the Widgets namespace...

UBUNTU-CVE-2020-35475

In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. The right colum...

Treck TCP/IP Buffer Error Vulnerability

Treck TCP/IP is a TCP Transmission Control Protocol/IP Internet Interconnection Protocol suite from Treck, Inc. dedicated to embedded systems. A security vulnerability exists in Treck TCP/IP stack version 6.0.1.67 and prior versions, which stems from a vulnerability in the Treck HTTP server...

Adobe Experience Manager XSS

The vulnerability of the Adobe Experience Manager content and media management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary HTML code in the user’s browser remotely...

CVE-2020-7549

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules see security notification for affected versions, that could cause denial of HTTP and FTP...

Frappe Framework Input Validation Error Vulnerability

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. A security vulnerability exists in Frappe Framework 12 and 13 that stems from not properly validating Frappe's HTTP methods...

PT-2020-19625

Name of the Vulnerable Software and Affected Versions Modicon M340 versions affected versions not specified Modicon Quantum versions affected versions not specified Modicon Premium versions affected versions not specified Description A vulnerability exists in the Web Server of the affected device...

OpenAsset Digital Asset Management software has a cross-site scripting vulnerability

Openasset is a digital asset management software for the website building industry from Openasset UK. The OpenAsset Digital Asset Management software product suffers from an XSS injection vulnerability that could allow a remote attacker to inject arbitrary JavaScript or HTML for later rendering b...

Schneider Electric Modicon M340 code issue vulnerability

The Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure from Schneider Electric, France. A code issue vulnerability exists in the Schneider Electric Modicon M340, which can be exploited by an attacker to compile a request to...

PHPOffice PhpSpreadsheet Cross-Site Scripting Vulnerability

PHPOffice PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. A security vulnerability exists in version 0.0.0 of phpoffice/phpspreadsheet, which originates from the affected package phpoffice phpspreadsheet from 0.0.0. The library is susceptible to XSS attacks when creatin...

PT-2020-6371 · Schneider Electric · Modicon M340 +2

Name of the Vulnerable Software and Affected Versions: Modicon M340, Modicon Quantum, Modicon Premium affected versions not specified Description: The issue is related to insufficient checking of unusual or exceptional conditions in the software of programmable logic controllers. This could allow...

AZL-7384 CVE-2020-17527 affecting package tomcat 9.0.39-6

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this...

IBM Cloud Pak for Security Information Leakage Vulnerability

IBM Cloud Pak for Security is an integrated security tool that uses a unified interface to provide deep insight into threats in hybrid multi-cloud environments. An information disclosure vulnerability exists in IBM Cloud Pak for Security 1.3.0.1. An attacker could exploit the vulnerability via a...

Segment Component Unauthorized Access

The vulnerability of the Segment component in Oracle Retail Customer Management and Segmentation Foundation software relates to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information using the HTTP protocol...

Oracle Retail Customer Management Promotions Unauthorized Access

The vulnerability of the Promotions component of the Oracle Retail Customer Management and Segmentation Foundation software is related to lack of access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information using the HTTP protocol...

PHP interpreter suffers from an out-of-bounds read vulnerability (CNVD-2020-69476)

PHP PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language jointly maintained by the PHPGroup and the open source community. An out-of-bounds read vulnerability exists in the PHP interpreter, which can be exploited by an attacker to...

PHP interpreter suffers from an out-of-bounds read vulnerability (CNVD-2020-69474)

PHP PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language jointly maintained by the PHPGroup and the open source community. An out-of-bounds read vulnerability exists in the PHP interpreter, which can be exploited by an attacker to...

PHP interpreter has an out-of-bounds read vulnerability

PHP PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language jointly maintained by the PHPGroup and the open source community. An out-of-bounds read vulnerability exists in the PHP interpreter, which can be exploited by an attacker to...

CVE-2020-28210

A CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser...