8534 matches found
PT-2020-1585
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.5 through 12.2.9 Description The issue is related to insufficient access control in the Attachments / File Upload component of the Oracle Applications Framework product. It allows an unauthenticated attack...
PT-2020-1526
Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server version 10.3.6.0.0 Description The issue is related to insufficient access control in the WLS Core Components of Oracle WebLogic Server, allowing a high-privileged attacker with network access via HTTP to compromise the...
PT-2020-1359
Name of the Vulnerable Software and Affected Versions Primavera P6 Enterprise Project Portfolio Management versions 15.1.0.0 through 15.2.18.7 Primavera P6 Enterprise Project Portfolio Management versions 16.1.0.0 through 16.2.19.0 Primavera P6 Enterprise Project Portfolio Management versions...
CVE-2019-4559
IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 166355...
OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765)
Vulnerability in the Java SE product of Oracle Java SE component: Javadoc. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful...
NewStart CGSL CORE 5.05 / MAIN 5.05 : mercurial Multiple Vulnerabilities (NS-SA-2019-0234)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has mercurial packages installed that are affected by multiple vulnerabilities: - Mercurial version 4.5 and earlier contains a Incorrect Access Control CWE-285 vulnerability in Protocol server that can result in Unauthorized da...
PT-2019-17948
Name of the Vulnerable Software and Affected Versions Cybozu Office versions 10.0.0 through 10.8.3 Description The issue allows remote authenticated attackers to bypass access restrictions, potentially resulting in obtaining data without proper access privileges. This is achieved via the...
The vulnerability of the relational database management system used by Microsoft Access programs in Microsoft Office and Office 365 allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the relational database management system used in Microsoft Access programs from Microsoft Office and Office 365 is related to errors in object processing in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information throu...
The vulnerability of the relational database management system used by Microsoft Access programs in Microsoft Office and Office 365 allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the relational database management system used in Microsoft Access programs from Microsoft Office and Office 365 is related to errors in object processing in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information throu...
CVE-2019-17335: Undefined Security Weakness
The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacke...
JVN#79854355: Multiple vulnerabilities in Cybozu Office
Cybozu Office provided by Cybozu, Inc. contains multiple vulnerabilities listed below. Directory traversal in the "Customapp" function CWE-22 - CVE-2019-6022 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N| Base Score: 7.7 CVSS v2|...
PT-2019-15095
Name of the Vulnerable Software and Affected Versions TIBCO Spotfire Analytics Platform for AWS Marketplace version 10.6.0 TIBCO Spotfire Server versions 7.11.7 and below TIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3,...
Intel Baseboard Management Controller Information Disclosure Vulnerability
The Intel Baseboard Management Controller BMC is a baseboard management controller from Intel Corporation USA. An information disclosure vulnerability exists in Intel BMC, which arises from errors in the configuration of a networked system or product during operation, and can be exploited by an...
JDK: unspecified vulnerability fixed in 8u221 (Deployment)
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Deployment. The supported version that is affected is Java SE: 8u221; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...
PT-2019-5228
Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 9.0.0.M1 through 9.0.29 Apache Tomcat versions 8.5.0 through 8.5.49 Apache Tomcat versions 7.0.0 through 7.0.98 Description The issue is related to a session fixation attack when using FORM authentication. An attacker...
CVE-2019-11255
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner v0.4.3, v1.0.2, v1.1, v1.2.2, v1.3.1, external-snapshotter v0.4.2, v1.0.2, v1.1, 1.2.2, and external-resizer v0.1, v0.2 could result in unauthorized PersistentVolume data access or volume mutation during...
NewStart CGSL CORE 5.04 / MAIN 5.04 : mercurial Multiple Vulnerabilities (NS-SA-2019-0216)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has mercurial packages installed that are affected by multiple vulnerabilities: - Mercurial version 4.5 and earlier contains a Incorrect Access Control CWE-285 vulnerability in Protocol server that can result in Unauthorized da...
The vulnerability of the DirectWrite programming interface in Windows operating systems allows attackers to gain unauthorized access to protected information.
The vulnerability of the DirectWrite programming interface in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created web page or document...
syndesis: default CORS configuration is allow all
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to conduct phishing attacks and further access unauthorized information...