DEBIAN-CVE-2020-12872

yawsconfig.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0...

PT-2020-10763 · Trustwave +1 · Opendmarc +1

Name of the Vulnerable Software and Affected Versions: OpenDMARC versions 1.3.2 and 1.4.x Description: The issue allows attacks to bypass SPF and DMARC authentication when the HELO field is inconsistent with the MAIL FROM field, specifically when OpenDMARC is used with pypolicyd-spf 2.0.2...

PT-2020-6230 · Libslirp +8 · Libslirp +8

Name of the Vulnerable Software and Affected Versions: libslirp versions 4.2.0 and prior releases Description: The issue is related to a use after free vulnerability in the ip reass function in ip input.c of the libslirp library. This vulnerability can be exploited by crafted packets, leading to ...

Oracle Virtualization VM VirtualBox Unauthorized Operation Vulnerability

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The product is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...

Plat'Home EasyBlocks IPv6 Authorization Issues Vulnerability

Plat'Home EasyBlocks IPv6 is an IPv6 address set allocation unit product from Plat'Home Japan. An authorization issue vulnerability exists in Plat'Home EasyBlocks IPv6 version 2.0.1 and earlier Enterprise Edition and version 2.0.1 and earlier. The vulnerability can be exploited by an attacker to...

Dell EMC Isilon OneFS Access Control Error Vulnerability

Dell EMC Isilon OneFS is a horizontally scalable storage system for unstructured data from Dell USA. An access control error vulnerability exists in Dell EMC Isilon OneFS versions prior to 8.2.0. The vulnerability arises from the network system or product not properly restricting access to...

VideoLAN VLC Media Player Cross-Site Scripting Vulnerability (CNVD-2020-08120)

VideoLAN VLC media player is a free, open source cross-platform multimedia player also a multimedia framework organized by VideoLAN France. The product supports the playback of a variety of media files, CD-ROMs, etc., a variety of audio and video formats WMV, MP3, etc. and so on. A cross-site...

CVE-2020-5521

The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2020-18487

Name of the Vulnerable Software and Affected Versions PHPGurukul Hostel Management System version 2.0 Description The issue allows SQL injection via the id parameter in the "full-profile.php" file. This could potentially be exploited to extract or modify sensitive data. Recommendations For...

IceWarp WebMail Server Cross-Site Scripting Vulnerability

IceWarp WebMail Server is a Web-based mail server product from the U.S. company IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. A cross-site scripting vulnerability exists in IceWarp WebMail Server version 12.2.0 and version 12.1.x prior to...

Cisco DNA Spaces:Connector Input Validation Error Vulnerability

Cisco DNA Spaces is a set of indoor location services platform from Cisco.Cisco DNA Spaces:Connector is one of the connectors used to support the communication of Cisco wireless controllers. An input validation error vulnerability exists in versions prior to Cisco DNA Spaces: Connector 2.0, which...

Broadcom Brocade SANnav Information Disclosure Vulnerability (CNVD-2019-41466)

Broadcom Brocade SANnav is a suite of SAN management platforms from Broadcom USA. A security vulnerability exists in the authentication mechanism in Broadcom Brocade SANnav versions prior to 2.0. A local attacker could exploit this vulnerability to access sensitive information...

SQL Injection Vulnerability in Kaixin Quote System V2.0 da***.aspx Page

The QI Quotation System is primarily for use by manufacturing companies. For incoming BOM list price monitoring. The system will automatically record the past quoted prices of BOM products, so that the purchasing staff can easily give new quotes. A SQL injection vulnerability exists in the Qixing...

PT-2019-7492 · Pippin Williamson · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads EDD versions 1.8.x through 1.8.6 Easy Digital Downloads EDD versions 1.9.x through 1.9.9 Easy Digital Downloads EDD versions 2.0.x through 2.0.4 Easy Digital Downloads EDD versions 2.1.x through 2.1.10 Easy Digital...

WiKID Systems 2FA Enterprise Server Cross-Site Request Forgery Vulnerability

WiKID Systems 2FA Enterprise Server is a two-factor authentication server from WiKID Systems, USA. A cross-site request forgery vulnerability exists in WiKID 2FA Enterprise Server version 4.2.0-b2053 and earlier. The vulnerability stems from a WEB application that does not adequately validate tha...

CVE-2019-17119

Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter...

CVE-2019-2939

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via OracleNet to compromise Core RDBMS. While th...

PT-2019-14527 · Jobberbase · Jobberbase

Name of the Vulnerable Software and Affected Versions: Jobberbase version 2.0 Description: The issue arises from the lack of sanitization of the category parameter in the public/page subscribe.php file, leading to a SQL injection vulnerability in the /subscribe endpoint. Recommendations: For...

WordPress js-support-ticket plugin cross-site request forgery vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in versions of the WordPress js-support-ticket plugin prior to version 2.0....

CVE-2018-13367

An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain platform information such as version, models, via parsing a JavaScript file through admin webUI...