CVE-2020-1847

There is a denial of service vulnerability in some Huawei products. There is no protection against the attack scenario of specific protocol. A remote, unauthorized attackers can construct attack scenarios, which leads to denial of service.Affected product versions include:NIP6300 versions...

CVE-2020-12333

Insufficiently protected credentials in the IntelR QAT for Linux before version 1.7.l.4.10.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-8753

CVE-2020-8753 is an out-of-bounds read vulnerability in the DHCP subsystem of Intel AMT/ISM (and related components in the Intel CSME/SPS/TXE/SO CSME stack). Affected versions are Intel AMT/ISM before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45. The flaw may allow an unauthenticated attacker...

The vulnerability of the Magento Commerce software platform for developing and managing online stores lies in the lack of measures to protect SQL query structures. This allows attackers to execute arbitrary SQL queries against the database in the target system and gain access to protected information.

The vulnerability of the Magento Commerce development and management software platform lies in the lack of measures to protect SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database in the target system by sending a...

PT-2020-4817 · Microsoft · Windows Walletservice +1

Name of the Vulnerable Software and Affected Versions: Windows WalletService affected versions not specified Description: The issue is related to a lack of protection for service data in the Windows WalletService component of the Windows operating system. This can allow an attacker to gain...

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Foundation, and Microsoft SharePoint Enterprise Server lies in the lack of protection for operational data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Foundation, and Microsoft SharePoint Enterprise Server lies in the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Picketlink component of the JBoss Enterprise Application Platform allows a perpetrator to execute cross-site scripting attacks.

The vulnerability of the Picketlink component in the JBoss Enterprise Application Platform exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the JBoss Enterprise Application Platform exists due to the lack of measures taken to protect the website structure. This allows attackers to perform cross-site scripting attacks and disclose the protected information.

The vulnerability of the JBoss Enterprise Application Platform exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks and disclose sensitive information by using an SAMLRequest...

GHSA-4FC4-CHG7-H8GH Unprotected dynamically loaded chunks

Impact All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. Patches This issue is...

Rockwell Automation ISaGRAF5 Runtime (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ISaGRAF5 Runtime Vulnerabilities: Use of Hard-coded Cryptographic Key, Unprotected Storage of Credentials, Relative Path Traversal, Uncontrolled Search Path Element,...

DEBIAN-CVE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the...

WordPress Backup, Restore and Migrate plugin 4.2.1 – 4.2.12 - Unprotected AJAX Action to Arbitrary File Overwrite and Sensitive Information Disclosure vulnerability

Unprotected AJAX Action to Arbitrary File Overwrite and Sensitive Information Disclosure vulnerability discovered by Chloe Chamberland WordFence in WordPress Backup, Restore and Migrate plugin versions 4.2.1 – 4.2.12. Solution Update the WordPress Backup, Restore and Migrate plugin to the latest...

XCloner Backup and Restore 4.2.1 - 4.2.12 - Unprotected AJAX Action

"This flaw gave authenticated attackers, with subscriber-level or above capabilities, the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution on a vulnerable site’s server. Alternatively, an attacker could create an exploit cha...

WordPress XCloner Backup and Restore plugin <= 4.2.12 - Unprotected AJAX Action vulnerability

Unprotected AJAX Action vulnerability found by Chloe Chamberland in WordPress XCloner Backup and Restore plugin versions = 4.2.12. Solution Update the WordPress XCloner Backup and Restore plugin to the latest available version at least 4.2.13...

XCloner Backup and Restore 4.2.1 - 4.2.12 - Unprotected AJAX Action

"This flaw gave authenticated attackers, with subscriber-level or above capabilities, the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution on a vulnerable site’s server. Alternatively, an attacker could create an exploit cha...

The vulnerability of the Win32k component of the Windows operating system, which allows a hacker to disclose protected information

The vulnerability of the Win32k component of the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created application...

The vulnerability of the Microsoft Dynamics 365 resource planning software lies in the lack of protective measures for the website structure, allowing attackers to execute cross-site scripting attacks.

The vulnerability of the Microsoft Dynamics 365 resource planning software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using specially crafted requests...

The vulnerability of the libsuri component of the Oracle Solaris operating system, which allows a perpetrator to gain unauthorized access to protected information

The vulnerability of the libsuri component in the Oracle Solaris operating system is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2020-7529

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Transversal' vulnerability exists in SCADAPack 7x Remote Connect V3.6.3.574 and prior which allows an attacker to place content in any unprotected folder on the target system using a crafted .RCZ file...

CVE-2020-7529

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Transversal' vulnerability exists in SCADAPack 7x Remote Connect V3.6.3.574 and prior which allows an attacker to place content in any unprotected folder on the target system using a crafted .RCZ file...