4127 matches found
Parallels Desktop Information Disclosure Vulnerability (CNVD-2020-46853)
Parallels Desktop is a virtual machine software that runs on Mac computers. An information disclosure vulnerability exists in the HOSTIOCTLINITHYPERVISOR handler in prlhypervisor kext in versions prior to Parallels Desktop 16.0.0 48916. The vulnerability stems from unprivileged users being able t...
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
...
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
...
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
...
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service.
...
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
...
SAP Adaptive Server Enterprise Information Disclosure Vulnerability (CNVD-2020-46790)
SAP Adaptive Server Enterprise ASE is a relational database server from SAP, Germany. An information disclosure vulnerability exists in SAP ASE version 16.0. An attacker could exploit the vulnerability to access encrypted sensitive information...
Huawei FusionCompute Command Injection Vulnerability
Huawei FusionCompute is a computer virtualization engine from Huawei China. The product provides Virtual Resource Manager VRM and Compute Node Agent CNA, among others. A command injection vulnerability exists in Huawei FusionCompute version 8.0.0, which stems from the device not adequately...
QEMU Input Validation Error Vulnerability (CNVD-2020-46814)
QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A security vulnerability exists in QEMU 5.0.0 and earlier versions. An attacker could exploit the vulnerability to cause a...
CVE-2019-17339
The VirtualRouter component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that theoretically allows an attacker to inject scripts via URLs. The attacker could theoretically social engineer an authenticated user into submitting the URL, thus executing the script on the...
CVE-2020-4541
IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183039...
Inductive Automation Ignition Authorization Issues Vulnerability
Inductive Automation Ignition is a data acquisition and monitoring system SCADA from Inductive Automation USA. A security vulnerability exists in Inductive Automation Ignition versions prior to 8 8.0.13. An attacker could exploit the vulnerability to obtain sensitive information...
CVE-2020-7352
The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, static RSA private key, an attacker with this key material and local user permissions can effectively send any operating system command to the...
Huawei FusionCompute Information Disclosure Vulnerability (CNVD-2020-46464)
Huawei FusionCompute is a computer virtualization engine from Huawei China. The product provides Virtual Resource Manager VRM and Compute Node Agent CNA, among others. An information disclosure vulnerability exists in Huawei FusionCompute version 8.0.0, which originates from the program failing t...
Huawei FusionSphere OpenStack Protection Mechanism Failure Vulnerability
Huawei FusionSphere OpenStack is an OpenStack-based cloud operating system from Huawei, China. A security vulnerability exists in Huawei FusionSphere OpenStack version 8.0.0, which stems from the program incorrectly using a protection mechanism. An attacker could exploit the vulnerability to...
File Upload Vulnerability in Verydows 2.0 Backend
Verydows is a free and open source e-commerce management system developed using PHP, featuring cross-platform, lightweight, high performance and strong security. Verydows 2.0 backend file upload vulnerability, attackers can exploit the vulnerability to obtain server privileges...
CVE-2020-14520
The affected product is vulnerable to an information leak, which may allow an attacker to obtain sensitive information on the Ignition 8 all versions prior to 8.0.13...
Huawei FusionCompute License Issue Vulnerability
Huawei FusionCompute is a computer virtualization engine from Huawei China. The product provides Virtual Resource Manager VRM and Compute Node Agent CNA, among others. An authorization issue vulnerability exists in Huawei FusionCompute version 8.0.0, which stems from a module not properly...
LibreHealth EHR Cross-Site Request Forgery Vulnerability
LibreHealth EHR is a free open source electronic health record and medical practice management application. LibreHealth EHR 2.0.0 suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to send unintended requests to the server via an affected client...