mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.017 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

PT-2020-3466 · Red Hat · Red Hat Satellite

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite 6 Description: The issue is related to inadequate access control in Red Hat Satellite, allowing a privileged attacker to read cache files. These cache credentials could help the attacker gain complete control of the Satellit...

Information disclosure

On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell tmsh privileges are able access object...

PT-2019-17561 · Huawei · Huawei S5700 +2

Name of the Vulnerable Software and Affected Versions: Huawei S5700 and S6700 affected versions not specified Description: The issue is related to a DoS security vulnerability. Attackers with certain permissions can perform specific operations on affected devices, exploiting the vulnerability due...

389-ds-base: replication and the Retro Changelog plugin store plaintext password by default

By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext...

SUSE-SU-2019:2155-1 Security update for 389-ds

This update for 389-ds to version 1.4.0.26 fixes the following issues: Security issues fixed: - CVE-2016-5416: Fixed an information disclosure where a anonymous user could read the default ACI bsc991201. - CVE-2018-1054: Fixed a denial of service via search filters in SetUnicodeStringFromUTF8...

mysql: Server: Options unspecified vulnerability (CPU Jul 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Options. Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocol...

Improper Access Control

MySQL is vulnerable to improper access control. High privileged attackers with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash complete DOS of MySQL Server...

CVE-2019-2495

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: DDL. Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2019-2536

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Packaging. Supported versions that are affected are 8.0.13 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MyS...

CVE-2017-15138

The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens...

CloudBees Jenkins Shelve Project Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks . Shelve Project Plugin is used in one of the project...

CVE-2016-8608

CVE-2016-8608 applies to Red Hat JBoss BRMS 6 and BPM Suite 6. The flaw is a stored XSS in the business process editor caused by an incomplete fix for CVE-2016-5398. Remote, authenticated users with privileges to create business processes can store scripts that are not properly sanitized before d...

CVE-2018-8716

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers...

Cross site scripting

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers...

CVE-2018-8716

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers...

CVE-2018-2607

Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications subcomponent: Base. The supported version that is affected is 4.2.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hospitality Gue...

openstack-nova: Nova network denial of service through API filtering

A denial of service flaw was found in the way OpenStack Compute nova looked up VM instances based on an IP address filter. An attacker with sufficient privileges on an OpenStack installation with a large amount of VMs could use this flaw to cause the main nova process to block for an extended...

CVE-2003-1233

Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier is affected. The root cause is the ability to create a symbolic link via NtCreateSymbolicLinkObject to access sensitive kernel resources, specifically to \Device\PhysicalMemory or via a drive letter created with subst. This bypas...

CVE-2003-1233

Pedestal Software Integrity Protection Driver IPD 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymbolicLinkObject function to create a symbolic link to 1 \Device\PhysicalMemory or 2 to a drive letter...