CVE-2020-25161

The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem and remotely execute code as an administrator...

Rocket.Chat Cross-Site Scripting Vulnerability (CNVD-2021-09040)

Rocket.Chat is an open source team chat software. A cross-site scripting vulnerability exists in Rocket.Chat server versions prior to 3.9.0, which stems from the drag-and-drop functionality being susceptible to XSS attacks. No details of the vulnerability are available at this time...

CVE-2020-14221

HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users...

tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become...

Google Discloses Severe Bug in Libgcrypt Encryption Library—Impacting Many Projects

A "severe" vulnerability in GNU Privacy Guard GnuPG's Libgcrypt encryption software could have allowed an attacker to write arbitrary data to the target machine, potentially leading to remote code execution. The flaw, which affects version 1.9.0 of libgcrypt, was discovered on January 28 by Tavis...

Rocket.Chat 跨站脚本漏洞

Rocket.Chat is an open source team chat software. A cross-site scripting vulnerability exists in Rocket.Chat server versions prior to 3.9.0, which stems from the drag-and-drop functionality being susceptible to XSS attacks. No details of the vulnerability are available at this time...

jsoneditor Cross-site Scripting Vulnerability

Josdejong Jsoneditor is a web page based software for viewing, editing, and verifying Json data by the individual developer Josdejong. A cross-site scripting vulnerability exists in jsoneditor before 9.0.2, which allows the vulnerability to be triggered by injecting and executing JavaScript...

tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become...

Buffer Error Vulnerability in Multiple Samsung Products

Samsung mobile devices O are products of Samsung Corporation in South Korea.Samsung mobile devices O is a series of cell phones.Samsung mobile devices P is a series of mobile hard drives.Samsung mobile devices Q is a series of TVs.Samsung mobile devices Q is a series of TVs. Samsung mobile device...

Google Android Input Validation Error Vulnerability

Google Android is a Linux-based open source operating system from the USGoogleOpen Handheld Alliance Google. Google Android OS 9.0, 10.0 suffers from an input validation error vulnerability that could allow a malicious application to elevate privileges on the system...

UBUNTU-CVE-2020-27752

A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data...

Adobe Prelude 代码问题漏洞

Adobe Prelude is a video recording and capture tool designed for intuitive and efficient media organization and metadata entry, quickly tagging and transcoding video footage and creating rough cuts on the fly. An uncontrolled search path vulnerability exists in Adobe Prelude 9.0.1 and earlier...

Microsoft Dynamics 365 Cross-Site Scripting Vulnerability

Microsoft Dynamics 365 is a suite of ERP business solutions for multinational organizations from Microsoft USA. The product includes financial management, production management and business intelligence management. A cross-site scripting vulnerability exists in Microsoft Dynamics 365. The followi...

HCL Technologies Digital Experience Cross-Site Scripting Vulnerability

HCL Technologies Digital Experience is a suite of digital experience platforms, content delivery solutions from HCL Technologies India. HCL Digital Experience versions 8.5, 9.0, 9.5 have a cross-site scripting vulnerability where a sub-component is susceptible to an XSS attack where in the...

HCL Digital Experience Cross-Site Scripting Vulnerability

HCL Technologies Digital Experience is a suite of digital experience platforms, content delivery solutions from HCL Technologies India. A cross-site scripting vulnerability exists in HCL Digital Experience version 8.5, 9.0, 9.5. The vulnerability stems from the lack of proper validation of...

PYSEC-2020-110

In the Channelmgnt plug-in for Sopel a Python IRC bot before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2...

CVE-2020-4661

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system. IBM X-Force ID: 186142...

Vulnerabilities fixed in IBM Security Access Manager

IBM has fixed multiple vulnerabilities in IBM Security Access Manager. A malicious party could potentially exploit the vulnerabilities to obtain information about the system. Little substantive information about the vulnerabilities has been made publicly available. IBM has released updates to fix...

CVE-2020-12815

An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker to inject script related HTML tags via IPv4/IPv6 address fields...

CVE-2020-2036

A reflected cross-site scripting XSS vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could...