PT-2020-3630 · Roundcube +4 · Roundcube Webmail +4

Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions 1.2.10 and earlier, 1.3.x before 1.3.14, and 1.4.x before 1.4.7 Description: The issue allows for cross-site scripting XSS via a crafted HTML e-mail message. This can be demonstrated by a JavaScript payload in the...

Cryptocat Input Validation Error Vulnerability (CNVD-2019-40145)

Cryptocat is an open source online cryptographic chat application. A security vulnerability exists in versions of Cryptocat prior to 2.0.22. An attacker can exploit this vulnerability to cause the application to generate invalid HTML code...

Web Access component of

The vulnerability of the Web Access component of the Oracle Primavera P6 Enterprise Project Portfolio Management application relates to deficiencies in access control. Exploiting this vulnerability may allow an attacker, operating remotely, to gain access to modify, add, or delete data using HTTP...

Web Access component of Unauthorized Access

The vulnerability of the Web Access component of the Oracle Primavera P6 Enterprise Project Portfolio Management application relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using th...

Outside In Filters Component Data Compromise

The vulnerability of the Outside In Filters component within the Oracle Outside In Technology SDK is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise data integrity, gain access to confidential information, and cause partial service...

Fluid Core Oracle PeopleSoft Enterprise PeopleTools Unauthorized Access

The vulnerability of the Fluid Core component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected data or compromise the integrity of...

Order Tracker Sub-component Oracle E-Business Suite Data Access Privilege Escalation

The vulnerability of the Order Tracker sub-component of the Oracle iStore component in the Oracle E-Business Suite automation system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain...

Siebel Core Component Unauthorized Access

The vulnerability of Siebel Core – DB Deployment and Configuration of the Oracle Siebel CRM system’s customer relationship management system – is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

Mozilla: Incorrect HTML parsing results in XSS bypass technique

A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...

Mozilla: Incorrect HTML parsing results in XSS bypass technique

A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...

chromium-browser: Google URI shown for certificate warning

Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page...

chromium-browser: Use-after-free in IndexedDB

Use after free in IndexedDB in Google Chrome prior to 77.0.3865.120 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page...

chromium-browser: Chrome web store origin needs to be isolated

Insufficient policy enforcement in site isolation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page...

BI Platform Security Sub-component Privilege Escalation

The vulnerability of the BI Platform Security sub-component of the Business Intelligence Enterprise Edition software platform of Oracle Fusion Middleware is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...

Loan Calculator Sub-component Data Modification

The vulnerability of the Loan Calculator sub-component of the Oracle Banking Digital Experience component of the banking analytics system’s simulation model, Oracle Financial Services Applications, is related to lack of access control. Exploiting this vulnerability could allow a malicious actor t...

Apache HTTP Server HTTP/2 DoS

The vulnerability of the HTTP/2 network protocol implementation in the Apache HTTP Server is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

PeopleSoft Enterprise Integration Broker Unauthorized Access

The vulnerability of the Integration Broker component of the PeopleSoft Enterprise PeopleTools business application package of Oracle PeopleSoft Enterprise is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...

PeopleSoft Enterprise Stylesheet Sub-component Data Modification

The vulnerability of the Stylesheet sub-component of the PeopleSoft Enterprise PeopleTools business application package from Oracle PeopleSoft Enterprise is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify,...