CVE-2018-19954

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10...

osTicket Server-Side Request Forgery Vulnerability

osTicket is a widely used and trusted open source work order support ticket system. A server-side request forgery vulnerability exists in osTicket versions prior to 1.14.3. An attacker can exploit this vulnerability to add malicious files to the server or perform port scans...

Synology DiskStation Manager Information Disclosure Vulnerability

Synology DiskStation Manager DSM is a product of Synology Inc. of Taiwan, China DSM, etc. Synology DiskStation Manager is a set of operating systems for use on networked storage servers NAS.HTTPS Hypertext Transfer Protocol Secure, etc. are products of HTTPS, a web-based secure transfer protocol,...

Pulse Connect Secure/Pulse Policy Secure Arbitrary Cookie Injection Vulnerability

Pulse Connect Secure is the mobile VPN that gives you secure access to enterprise applications and services in the data center or cloud from any device.Pulse Policy Secure is a suite of NAC and BYOD solutions. An arbitrary cookie injection vulnerability exists in Pulse Connect Secure/Pulse Policy...

PT-2020-20069 · Pulse · Pulse Connect Secure +1

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure / Pulse Policy Secure versions prior to 9.1R9 Description: A vulnerability could allow attackers to conduct Cross-Site Scripting XSS and Open Redirection for authenticated user web interface. Recommendations: For versions...

BigBlueButton Server-Side Request Forgery Vulnerability

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A server-side request forgery vulnerability exists in versions prior to BigBlueButton 2.2.7 that allows an attacker to read a local file and perform an SSRF attack via an uploaded Office document with a...

HPE Intelligent Management Center (iMC) iccselectdevtype Expression Language Injection Remote Code Execution Vulnerability

HPE Intelligent Management Center iMC is a suite of network intelligent management center solutions from Hewlett Packard Enterprise HPE. The solution provides network-wide visibility and enables comprehensive management of resources, services and users. A security vulnerability exists in HPE...

PT-2020-5799 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.5.2 Description: The issue is related to a lack of privilege management mechanism in the WordPress content management system. Exploitation of this issue can allow a remote attacker to gain access to confidential...

PT-2020-5743 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.5.2 Description: The issue is related to the incorrect handling of deserialization requests in the wp-includes/Requests/Utility/FilteredIterator.php component of the WordPress content management system...

CVE-2020-26869

ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit...

UBUNTU-CVE-2020-13341

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer role to perform various deletions...

HPESBNW04036 rev.1 - HPE Intelligent Management Center (iMC) PLAT 7.3, Remote Code Execution

Potential Security Impact: Remote: Code Execution, Unauthorized Data Injection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Intelligent Management Center iMC - Prior to iMC PLAT 7.3 E0705P07 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2020-2462...

GLPI SQL Injection Vulnerability (CNVD-2020-67239)

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

CVE-2020-8109

A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. This can result in denial-of-service. This issue affects: Bitdefender Engines version 7.84892 and prior...

PT-2020-9195 · Pagure +1 · Pagure +1

Name of the Vulnerable Software and Affected Versions: Pagure versions prior to 5.6 Description: The issue allows for XSS via the templates/blame.html blame view. Recommendations: For versions prior to 5.6, update to version 5.6 or later to resolve the issue...

Gradle Enterprise Export API Authentication Vulnerability

Gradle is a set of JVM-based project build tools , it supports maven, Ivy repository and so on. A security vulnerability exists in Gradle Enterprise prior to version 2020.2.4. The vulnerability stemmed from an unrestricted cross-domain request for read-only data in the Export API. An attacker...

DEBIAN-CVE-2020-6552

Use after free in Blink in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2020-16198

When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or insufficiently proves the claim is correct...

PT-2020-14258 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 2.16.11 Helm versions prior to 3.3.2 Description: A Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs...

CVE-2020-14519

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...