RHEL 8 : python-paunch and openstack-tripleo-heat-templates (RHSA-2020:3410)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3410 advisory. Library and utility to launch and manage containers using YAML based configuration data. openstack-tripleo-heat-templates is a collection of OpenStac...

CSV Injection

cfme is vulnerable to CSV injection. The orchestration templates allow attackers to inject arbitrary CSV content such as formulas and exfiltrate data or further exploit other vulnerabilities...

PT-2020-4218

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings affected versions not specified Description: The issue is related to insufficient authorization enforcement for requests to delete scheduled meeting templates. An authenticated, remote attacker could exploit this by sendi...

The vulnerability of the Layout Templates component of the Oracle BI Publisher software allows a malicious individual to gain access to read, modify, add, or delete data.

The vulnerability of the Layout Templates component in the Oracle BI Publisher reporting software is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read, modify, add, or delete data using the HTTP protocol...

openstack-tripleo-heat-templates: No sVirt protection for OSP16 VMs due to disabled SELinux

A flaw was found in the novalibvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines...

Important: Red Hat Security Advisory: openstack-tripleo-heat-templates security update

An update for openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 16.1 Train. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Elementor < 2.9.14 - Authenticated Stored Cross-Site Scripting

The template name is not properly sanitised when output back, leading to a stored XSS issue. PoC Go to templates tab, click on "add new', and select page or section Then add XSS payload such as " on "name your template" field and hit create template...

Elementor < 2.9.14 - Authenticated Stored Cross-Site Scripting

The template name is not properly sanitised when output back, leading to a stored XSS issue. Go to templates tab, click on "add new', and select page or section Then add XSS payload such as " on "name your template" field and hit create template...

Unspecified Vulnerability in Oracle Fusion Middleware BI Publisher Layout Templates Component

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's Oracle business innovation platform for enterprise and cloud environments. The platform provides middleware, software collection and other functions. BI Publisher formerly known as XML Publisher is one of the reporting...

CVE-2020-14696

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware component: Layout Templates. Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2020-14696: Undefined Security Weakness

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware component: Layout Templates. Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

PT-2020-3315

Name of the Vulnerable Software and Affected Versions Oracle BI Publisher versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Description The issue is related to insufficient access control in the Layout Templates component of Oracle BI Publisher, allowing a remote attacker to gain read, modify, add, or...

CVE-2020-14172

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote...

Deserialization of untrusted data

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote...

CVE-2020-14172

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote...

Atlassian JIRA Server and Data Center Injection Vulnerabilities

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

CVE-2020-14172: Deserialization of Untrusted Data

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote...

PT-2020-13911

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 7.13.0 Atlassian Jira Server and Data Center versions 8.0.0 through 8.4.9 Atlassian Jira Server and Data Center versions 8.6.0 through 8.8.0 Description This issue allows remote attackers...

PT-2020-17843

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.5.5 Atlassian Jira Server and Data Center versions 8.6.0 through 8.7.1 Atlassian Jira Server and Data Center versions 8.8.0 Description The issue allows remote attackers to enumerate...

Atlassian JIRA Server and JIRA Data Center Injection Vulnerabilities

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...