Apache Airflow Operating System Command Injection Vulnerability

Apache Airflow is an open source platform for creating, managing and monitoring workflows. Apache Airflow suffers from an operating system command injection vulnerability that allows remote attackers to exploit the vulnerability to submit a specially crafted malicious load to execute arbitrary...

Online Trade - Online trading and cryptocurrency investment system security breach

Brynamics Online Trade is a system for trading cryptocurrencies online. A security vulnerability exists in Brynamics Online Trade. A remote attacker can exploit this vulnerability by making a direct request to /dashboard/addplan, /dashboard/paywithcard/charge, /dashboard/withdrawal, or...

CVE-2020-14644

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle...

CVE-2020-15507

An arbitrary file reading vulnerability in MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to read files on the system via unspecified vectors...

kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service

A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a "billion laughs" attack. The highest threat from this vulnerability is to system availability...

pocsuite

This is a Python-based framework for remote vulnerability testing and proof-of-concept development, known as Pocsuite. It is developed by the Knownsec Security Team and comes with a powerful proof-of-concept engine, many niche features for penetration testers and security researchers. The framewo...

CVE-2020-5601

Chrome Extension for e-Tax Reception System Ver1.0.0.0 allows remote attackers to execute an arbitrary command via unspecified vectors...

Arbitrary File Deletion Vulnerability in WebAccess SCADA at Advantech (China) Co.

Advantech WebAccess SCADA is a browser-based SCADA software package for supervisory control, data acquisition and visualization. It is used to automate complex industrial processes in the context of remote operation. An arbitrary file deletion vulnerability exists in Advantech China WebAccess...

The vulnerability of the Security component of the Oracle Retail Store Inventory Management software allows a hacker to gain full control over the application.

The vulnerability of Oracle Retail Store Inventory Management’s Security component is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTP protocol...

The vulnerability of the tooltip component in Bootstrap, a tool for creating websites and web applications, allows attackers to perform cross-site scripting attacks.

The vulnerability of the tooltip component in the Bootstrap toolset for creating websites and web applications is related to the lack of protective measures for website structures. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

CVE-2020-8329

A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is...

The vulnerability of the Active Directory Federation Services (ADFS) for Windows operating systems allows a perpetrator to carry out a cross-site scripting attack.

The vulnerability of Active Directory Federation Services ADFS on Windows operating systems is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform a cross-site scripting attack by sending a specially crafted request...

CouchDB 3.0.0 Remote Elevation of Privilege Vulnerability

CouchDB is a document-oriented database system developed using Erlang . A remote elevation of privilege vulnerability exists in CouchDB 3.0.0, which can be exploited by an attacker to gain server privileges...

IBM Maximo Anywhere Information Disclosure Vulnerability (CNVD-2020-25795)

IBM Maximo Anywhere is a suite of next-generation mobile solutions from IBM USA built on the IBM Worklight platform. The solution supports remote access to IBM Maximo Asset Management a comprehensive asset lifecycle and maintenance management solution workflow and asset management via mobile...

Evenroute IQrouter has an unspecified vulnerability (CNVD-2020-25366)

Evenroute IQrouter is an intelligent router from Evenroute USA. A security vulnerability exists in the 'diagsetpassword' function in the web panel in Evenroute IQrouter 3.3.1 and earlier versions. A remote attacker can exploit this vulnerability to arbitrarily change the root account password...

Foxit Reader and PhantomPDF Type Obfuscation Remote Code Execution Vulnerability (CNVD-2020-24443)

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in the handling of the Export command in Foxit Reader and Foxit PhantomPDF 9.7.1.29511 and earlier versions for Windows platforms, which stems from the program's failure t...

CVE-2020-2943

Vulnerability in the Oracle Financial Services Liquidity Risk Measurement and Management product of Oracle Financial Services Applications component: User Interface. Supported versions that are affected are 8.0.7 and 8.0.8. Easily exploitable vulnerability allows low privileged attacker with...

SAP Landscape Management Elevation of Privilege Vulnerability

SAP Landscape Management is a centralized SAP product management system from SAP. The system is used to centrally manage and configure SAP software systems running in physical, virtual, and cloud infrastructures. A security vulnerability exists in SAP Landscape Management version 3.0 and SAP...

CVE-2020-4289

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM...

The vulnerability of the command-line interface of the Cisco FXOS operating system, allowing a hacker to execute arbitrary commands

The vulnerability of the Cisco FXOS operating system’s command-line interface relates to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...