The vulnerability of the WordPress website content management system, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise the integrity of data.

The vulnerability of the WordPress content management system’s functions is related to an error in the execution of XSS attacks during shortcode rendering. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

Cybozu Garoon contains multiple vulnerabilities

Overview Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. Authentication bypass in the API used to specify the fields CWE-287 - CVE-2020-5563 Cross-site scripting in the application "E-mail" CWE-79 - CVE-2020-5564 Input validation bypass in the applications...

Cybozu Garoon Input Validation Error Vulnerability (CNVD-2020-26658)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. An input validation error vulnerability exists in Cybozu Garoon versions 4.0.0 through 4.10.3. A remote attacker...

CVE-2020-7134

A remote access to sensitive data vulnerability was discovered in HPE IOT + GCP versions: 1.4.0, 1.4.1, 1.4.2, 1.2.4.2...

The vulnerability of the Symfony software platform for developing and managing web applications stems from insufficient validation of input data, allowing attackers to compromise data integrity.

The vulnerability of the Symfony software development and management platform is related to an application error where unvalidated user input is passed as a file. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine, related to memory management after memory is freed, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of Google Chrome’s V8 browser kernel relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the multimedia library libvpx, related to reading beyond the buffer boundaries of memory, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the multimedia library libvpx is related to a memory-bound read error. Exploiting this vulnerability could allow an attacker to gain access to confidential data remotely...

CVE-2020-10903

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network acce...

OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network acce...

CVE-2019-20786

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

PT-2020-2597

Name of the Vulnerable Software and Affected Versions Java SE versions 7u251, 8u241, 11.0.6, and 14 Java SE Embedded version 8u241 Description The issue is related to insufficient input validation in the Lightweight HTTP Server component of Oracle Java SE and Java SE Embedded. This can be exploit...

The vulnerability of the CORS mechanism implementation in Google Chrome browsers, related to insufficient validation of input data, allows a perpetrator to gain unauthorized access to information.

The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to information through a specially created HTML page...

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird, related to an error in document extraction from DocShell, allows attackers to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the Firefox, Firefox ESR, and Thunderbird software is related to an error in document extraction from DocShell. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird, related to the use of memory after it is freed, allows attackers to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service interruptions...

Vulnerability of Firefox web browsers, Firefox ESR, and Thunderbird email client, related to a navigation event error that does not comply with W3C specifications, allowing attackers to access confidential data

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird is related to a navigation event error that does not comply with W3C specifications. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...

Establishing remote data center assessment standards

For the foreseeable future, the COVID-19 crisis has changed the very nature of on-site cybersecurity compliance assessments and testing. Leading the way, the Payment Card Industry Security Standards Council PCI SSC quickly recognized that its requirements for physical, on-site data center...

CVE-2020-8877

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to access sensitive data, compromise its integrity, and cause service failures.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to incorrect optimization settings. Exploiting this vulnerability can allow a remote attacker to access sensitive data, compromise its integrity, and cause service failures through a specially crafted HTML...

The vulnerability of the Database Gateway for ODBC component in the Oracle Database Server database management system allows a hacker to gain access to modify, add, or delete data, or to cause partial service interruption.

The vulnerability of the Oracle Database Server ODBC driver’s database server lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker to remotely modify, add, or delete data, or cause a partial service failure using the OracleNet network protocol...