kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service

A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a "billion laughs" attack. The highest threat from this vulnerability is to system availability...

pocsuite

This is a Python-based framework for remote vulnerability testing and proof-of-concept development, known as Pocsuite. It is developed by the Knownsec Security Team and comes with a powerful proof-of-concept engine, many niche features for penetration testers and security researchers. The framewo...

CVE-2020-5601

Chrome Extension for e-Tax Reception System Ver1.0.0.0 allows remote attackers to execute an arbitrary command via unspecified vectors...

Arbitrary File Deletion Vulnerability in WebAccess SCADA at Advantech (China) Co.

Advantech WebAccess SCADA is a browser-based SCADA software package for supervisory control, data acquisition and visualization. It is used to automate complex industrial processes in the context of remote operation. An arbitrary file deletion vulnerability exists in Advantech China WebAccess...

Security Component Full Control

The vulnerability of Oracle Retail Store Inventory Management’s Security component is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTP protocol...

Bootstrap Tooltip XSS

The vulnerability of the tooltip component in the Bootstrap toolset for creating websites and web applications is related to the lack of protective measures for website structures. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

CVE-2020-8329

A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is...

ADFS XSS

The vulnerability of Active Directory Federation Services ADFS on Windows operating systems is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform a cross-site scripting attack by sending a specially crafted request...

CouchDB 3.0.0 Remote Elevation of Privilege Vulnerability

CouchDB is a document-oriented database system developed using Erlang . A remote elevation of privilege vulnerability exists in CouchDB 3.0.0, which can be exploited by an attacker to gain server privileges...

IBM Maximo Anywhere Information Disclosure Vulnerability (CNVD-2020-25795)

IBM Maximo Anywhere is a suite of next-generation mobile solutions from IBM USA built on the IBM Worklight platform. The solution supports remote access to IBM Maximo Asset Management a comprehensive asset lifecycle and maintenance management solution workflow and asset management via mobile...

Evenroute IQrouter has an unspecified vulnerability (CNVD-2020-25366)

Evenroute IQrouter is an intelligent router from Evenroute USA. A security vulnerability exists in the 'diagsetpassword' function in the web panel in Evenroute IQrouter 3.3.1 and earlier versions. A remote attacker can exploit this vulnerability to arbitrarily change the root account password...

Foxit Reader and PhantomPDF Type Obfuscation Remote Code Execution Vulnerability (CNVD-2020-24443)

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in the handling of the Export command in Foxit Reader and Foxit PhantomPDF 9.7.1.29511 and earlier versions for Windows platforms, which stems from the program's failure t...

CVE-2020-2943

Vulnerability in the Oracle Financial Services Liquidity Risk Measurement and Management product of Oracle Financial Services Applications component: User Interface. Supported versions that are affected are 8.0.7 and 8.0.8. Easily exploitable vulnerability allows low privileged attacker with...

SAP Landscape Management Elevation of Privilege Vulnerability

SAP Landscape Management is a centralized SAP product management system from SAP. The system is used to centrally manage and configure SAP software systems running in physical, virtual, and cloud infrastructures. A security vulnerability exists in SAP Landscape Management version 3.0 and SAP...

CVE-2020-4289

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM...

Monit Default Credentials (HTTP)

Monit use the default credentials in a configuration file. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software...

Cisco FXOS Command Line Arbitrary Command Execution

The vulnerability of the Cisco FXOS operating system’s command-line interface relates to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

IBM Spectrum Protect Plus Command Execution Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

TP-LINK Cloud Cameras NCXXX Remote NULL Pointer Dereference Vulnerability

Vulnerability title: TP-LINK Cloud Cameras NCXXX Remote NULL Pointer Dereference Author: Pietro Oliva CVE: CVE-2020-10231 Vendor: TP-LINK Product: NC200, NC210, NC220, NC230, NC250, NC260, NC450 Affected version: NC200 = 2.1.8 build 171109, NC210 = 1.0.9 build 171214, NC220 = 1.3.0 build 180105,...

HPESBHF03993 rev.1 - HPE Superdome X servers with iLO4, Remote Multiple Vulnerabilities

Potential Security Impact: Remote: Denial of Service DoS, Multiple Vulnerabilities, memory corruption SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP Superdome X Base Enclosure prior to 8.8.2 HPE Integrity Superdome X Server prior to 8.8.2 HPE Integrity Superdome X with BL920s...