GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2 and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation the TLS server always uses wrong data in place of an encryption key derived from an application.

...

Ethereum Lottery Security Breach

Ethereum Lottery is an ethereum-based betting game. A security vulnerability in the 'PayWinner' function in Ethereum Lottery's simplelottery smart contract implementation stems from the fact that the 'PayWinner' function employs the publicly readable variable maxTickets to generate random values...

Zammad is vulnerable to authorization issues

Zammad is a Web-based open source helpdesk/customer support system. Zammad suffers from an authorization issue vulnerability that can be exploited by an attacker to register a new account using an email address that contains a non-existent domain of an existing organization, which in turn can be...

CVE-2020-14214

Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization...

Code injection

In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent e.g., read internal data, split, or merge...

CVE-2020-14214

Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization...

CVE-2020-14214

Vulnerability summary (CVE-2020-14214) : Zammad prior to 3.3.1 is vulnerable when Domain Based Assignment is enabled. The system relies on a claimed e-mail address for authorization decisions, enabling an attacker to register a new account that gains access to all tickets of an arbitrary Organiza...

DEBIAN-CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3. The earliest affected version is 3.6.4 2018-09-24 because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS...

Default credentials

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Red Hat Product Security does not consider this as a security flaw. Password changes aren't expected to...

CVE-2020-1703

CVE-2020-1703 entry is rejected and does not represent an active vulnerability.

Ethereum Lottery has a flawed logic vulnerability

Ethereum Lottery is an ethereum-based betting game.Ethereum Lottery's simplelottery smart contract implementation has a security vulnerability in the 'PayWinner' function that stems from the ' PayWinner' function uses the publicly readable variable maxTickets to generate random values. The...

CVE-2020-11466

An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve arbitrary information about all helpdesk tickets stored in database with numerous filters. This leaked sensitive information to unauthoriz...

Authentication flaw

An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve arbitrary information about all helpdesk tickets stored in database with numerous filters. This leaked sensitive information to unauthoriz...

CVE-2020-11466

CVE-2020-11466 affects Deskpro before 2019.8.0. The /api/tickets endpoint imperfectly validates user privileges, allowing an attacker to retrieve arbitrary information about all tickets and to obtain the ticket authentication code. This can lead to leaking sensitive ticket data and, in some cases...

PT-2020-12629

Name of the Vulnerable Software and Affected Versions Deskpro versions prior to 2019.8.0 Description An issue was discovered where the "/api/tickets" endpoint failed to properly validate a user's privilege. This allowed an attacker to retrieve arbitrary information about all helpdesk tickets stor...

CVE-2020-11466: Improper Privilege Management

An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve arbitrary information about all helpdesk tickets stored in database with numerous filters. This leaked sensitive information to unauthoriz...

CVE-2020-5292

Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and...

CVE-2020-5292: Improper Neutralization of Special Elements used in an SQL Command

Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and...

PT-2020-18381

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 2.0.15 Leantime versions prior to 2.1-beta3 Description The issue allows malicious users to execute arbitrary SQL queries, which can negatively affect the confidentiality, integrity, and availability of the site. Thi...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18338)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9. The...