PT-2020-5502 · Spring · Spring Framework

Name of the Vulnerable Software and Affected Versions: Spring Framework versions 4.3.0 through 4.3.28 Spring Framework versions 5.0.0 through 5.0.18 Spring Framework versions 5.1.0 through 5.1.17 Spring Framework versions 5.2.0 through 5.2.8 Description: The issue is related to insecure privilege...

CVE-2020-24623

A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V VHD...

mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2020)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

mysql: Server: Connection Handling unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Connection Handling. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2020)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

CVE-2020-16100

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket Configuration Client connections. Affected versions are...

mysql: C API unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

WordPress wp-file-manager Arbitrary File Upload Vulnerability

WordPress is a blogging platform developed using the PHP language. WordPress wp-file-manager has an arbitrary file upload vulnerability that can be exploited by a remote attacker to submit a special request, upload arbitrary PHP files, and execute arbitrary code...

oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c

A vulnerability was found in Oniguruma, where improper bounds checking in strlowercasematch within regexec.c can cause a heap-based buffer overflow, a remote attacker could exploit this flaw to crash the application or, in certain scenarios, execute arbitrary code. This occurs when the applicatio...

Pocsuite

This project, Pocsuite, is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec Security Team. It comes with a powerful proof-of-concept engine and many niche features for penetration testers and security researchers. The framework...

SecZetta NEProfile Host Injection Vulnerability

SecZetta NEProfile is a user-friendly solution that easily enables organizations to manage business processes for third-party identities. A security vulnerability exists in SecZetta NEProfile. A remote attacker who allows authentication could poison the host header, which could lead to the attack...

TIBCO Software Data Virtualization Arbitrary File Download Vulnerability

TIBCO Software Data Virtualization is an enterprise data virtualization solution. An arbitrary file download vulnerability exists in the TIBCO Data Virtualization Server component of TIBCO Software Data Virtualization, which can be exploited by a remote attacker to submit a special request to...

ArticaTech Artica Proxy Operating System Command Injection Vulnerability

ArticaTech Artica Proxy is an open source Artica proxy solution from the French company ArticaTech. A security vulnerability exists in the 'service-cmds' parameter of the cyrus.php file in Artica Web Proxy version 4.30.000000. A remote attacker could exploit the vulnerability to execute commands...

CVE-2019-4582

IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 167288...

Multiple Apple products Wi-Fi component out-of-bounds read vulnerability

Apple iOS and others are products of Apple Inc. Apple iOS is an operating system developed for mobile devices.Apple tvOS is an operating system for smart TVs.Apple iPadOS is an operating system for iPad tablets.Wi-Fi is one of the components of wireless Internet access. A security vulnerability...

Nagios XI Arbitrary Command Execution Vulnerability (CNVD-2020-64267)

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. An arbitrary command execution vulnerability exists in the ajaxhelper.php file in Nagios XI versions prior ...

Apache Airflow Operating System Command Injection Vulnerability

Apache Airflow is an open source platform for creating, managing and monitoring workflows. Apache Airflow suffers from an operating system command injection vulnerability that allows remote attackers to exploit the vulnerability to submit a specially crafted malicious load to execute arbitrary...

Online Trade - Online trading and cryptocurrency investment system security breach

Brynamics Online Trade is a system for trading cryptocurrencies online. A security vulnerability exists in Brynamics Online Trade. A remote attacker can exploit this vulnerability by making a direct request to /dashboard/addplan, /dashboard/paywithcard/charge, /dashboard/withdrawal, or...

CVE-2020-14644

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle...

CVE-2020-15507

An arbitrary file reading vulnerability in MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to read files on the system via unspecified vectors...