Schneider Electric EcoStruxure Building Operation WebStation Cross-Site Scripting Vulnerability

The EcoStruxure Building Operation WebStation is a web-based user interface for daily operations in the EcoStruxure BMS. A cross-site scripting vulnerability exists in EcoStruxure Building Operation WebStation 2.0 - 3.1. An attacker can exploit this vulnerability to inject HTML and JavaScript cod...

CVE-2020-12495

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. T...

The vulnerability of the Address Bar Handler component in the Yandex Browser for Android allows attackers to perform spoofing attacks.

The vulnerability of the Address Bar Handler component in the Yandex Browser for Android is related to errors in information representation by the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

Google Chrome Buffer Error Vulnerability

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in versions prior to Google chrome 87.0.4280.66, which stems from a heap buffer overflow in the UI...

Protecting Install Tool with Sudo Mode

When the system maintainer concept was introduced with TYPO3 v9.0.0 the necessity of having to enter a password when accessing the Install Tool via backend user interface was removed...

Mozilla Firefox and Mozilla Thunderbird Security Vulnerabilities

Mozilla Firefox and Mozilla Thunderbird are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open-source web browser. Mozilla Thunderbird is a suite of standalone Mozilla Application Suite Mozilla Thunderbird is a stand-alone e-mail client software from the Mozilla...

KLA12087 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability can be exploited to obtain sensitive information. ...

The vulnerability of the User Interface component of Oracle Communications Diameter Signaling Router software allows a attacker to gain unauthorized access to read, modify, add, or delete data.

The vulnerability of the User Interface component of Oracle Communications Diameter Signaling Router software lies in insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to read, modify, add, or delete data...

The vulnerability of the User Interface component of Oracle Communications Diameter Signaling Router software allows a attacker to gain unauthorized access to read, modify, add, or delete data.

The vulnerability of the User Interface component of Oracle Communications Diameter Signaling Router software lies in insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to read, modify, add, or delete data...

KLA12011 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to gain privileges, perform cross-site scripting attack, obtain sensitive information, cause denial of service, spoof user interface, execute arbitrary code, bypass security restrictions...

The vulnerability of the Windows operating system, related to errors in information representation by the user interface, allows attackers to perform spear-phishing attacks.

The vulnerability of the Windows operating system is related to errors in information representation by the user interface. Exploiting this vulnerability can allow attackers to perform spoofing attacks...

CVE-2020-4672

IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2020-63977)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting vulnerability exists in IBM Sterling B...

IBM Sterling B2B Integrator Path Traversal Vulnerability

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A path traversal vulnerability exists in IBM Sterling B2B...

OPENSUSE-SU-2020:1937-1 Security update for chromium

This update for chromium fixes the following issues: - Update to 86.0.4240.183 boo1178375 - CVE-2020-16004: Use after free in user interface. - CVE-2020-16005: Insufficient policy enforcement in ANGLE. - CVE-2020-16006: Inappropriate implementation in V8 - CVE-2020-16007: Insufficient data...

The vulnerability of Google Chrome’s user interface allows a hacker to compromise the rendering process and bypass the sandboxing protection mechanisms.

The vulnerability of Google Chrome’s user interface arises due to buffer overflow. Exploiting this vulnerability allows a malicious actor to compromise the rendering process and bypass the sandboxing mechanism by using a specially crafted HTML page...

IBM Content Navigator Cross-Site Scripting Vulnerability (CNVD-2020-62469)

IBM Content Navigator is a Web client that provides users with a console that enables them to access, manage, and use corporate content anytime, anywhere, from any location in the organization on virtually any mobile device. A cross-site scripting vulnerability exists in IBM Content Navigator...

Command execution vulnerability exists in MyuCMS (CNVD-2020-67557)

MyuCMS front-end is built with UIkit framework, back-end is built with layui back-end framework and back-end is developed with PHP+MYSQL. MyuCMS has a command execution vulnerability that can be exploited by attackers to gain server control privileges...

CVE-2020-4760

IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188737...

The vulnerability of the User Interface component of the Oracle Trade Management application, a part of the Oracle E-Business Suite, allows an attacker to gain unauthorized access to protected information or to modify, add, or delete data.

The vulnerability of the User Interface component of the Oracle Trade Management application, part of the Oracle E-Business Suite, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or to...