CVE-2020-20943

A Cross-Site Request Forgery CSRF in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL...

CVE-2020-20943

CVE-2020-20943 affects Qibosoft v7 (CMS). A CSRF flaw in the endpoint /member/post.php?job=postnew&step=post allows an attacker to coerce victims into arbitrarily publishing new articles via a crafted URL. The available connected documents confirm the vulnerability’ s existence and the affected c...

Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 Vaadin versions 8.0.0 through 8.12.4 allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses...

Security Bulletin: Power Hardware Management Console is Affected by Vulnerabilities in OpenSSL (CVE-2014-0224, CVE-2014-0221, CVE- 2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and servers. A remote attacker could exploit this...

CVE-2020-12083

An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 7.11.0-64...

CVE-2020-12083

An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 7.11.0-64...

CVE-2020-12082

CVE-2020-12082 affects the Web UI of Code Insight v7.x up to 2020 R1 (7.11.0-64), with a stored cross-site scripting (XSS) flaw. The Red Hat/EUVD/NVD entries corroborate a stored XSS in the Code Insight web UI, arising from unvalidated user data in certain UI areas. The available sources do not p...

Security Bulletin: A security vulnerability has been identified in IBM Java SDK shipped with IBM InfoSphere Optim Performance Manager (CVE-2015-4872)

Summary IBM Java SKD is shipped as a component of IBM InfoSphere Optim Performance Manager. Information about a security vulnerability affecting IBM Java SDK has been published in a security bulletin. Vulnerability Details CVEID: CVE-2015-4872 DESCRIPTION: An unspecified vulnerability in Oracle...

CVE-2020-14341

CVE-2020-14341 affects Red Hat Single Sign On (RHSSO) v7.x: the Test Connection feature in the console can cause SMTP connections to arbitrary hosts/ports from the RHSSO installation. This creates a timing side‑channel where an authorized user may infer information about hosts/ports they cannot s...

CVE-2020-6655

Eaton easySoft software v7.xx before 7.22 is affected by an out-of-bounds parsing/validation vulnerability in .E70 files, enabling local code execution or application crash. Root cause: improper parsing of E70 content. Affected products: easySoft v7.xx up to 7.21. Mitigation: upgrade to v7.22 (pa...

Security Bulletin: IBM MQ could leak sensitive information due to an error within the pre-v7 queue manager pubsub logic (CVE-2020-4319)

Summary IBM MQ could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error within the pre-v7 queue manager pubsub logic Vulnerability Details CVEID: CVE-2020-4319 DESCRIPTION: IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop...

OSV-2020-1835 Stack-buffer-overflow in fmt::v7::detail::buffer<char>::push_back

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25884 Crash type: Stack-buffer-overflow READ 1 Crash state: fmt::v7::detail::buffer::pushback std::1::backinsertiterator ::operator= fmt::v7::detail::bufferappender std::1::copyconstexprchar const, f...

CVE-2020-4319

IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub logic. IBM X-Force ID: 177402...

mySCADA myPRO 7 - Hardcoded Credentials

Exploit Title: mySCADA myPRO v7 Hardcoded Credentials Date: 2018-07-02 Exploit Author: Emre ÖVÜNÇ Vendor Homepage: http://myscada.org Software Link: https://www.myscada.org/mypro/ Version: v7.0.45 Tested on: Windows/Linux CVE-2018-11311 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1131...

v7-moving-pictures.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1159096 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Security Bulletin: Vulnerability in Curl used in OS image for RedHat Enterprise Linux for Cloud Pak System (CVE-2018-16842)

Summary Vulnerability in Curl used in OS image for RedHat Enterprise Linux in Cloud Pak System. OS image for RedHat Enterprise Linux has addresssd vulnerability. Vulnerability Details CVEID: CVE-2018-16842 DESCRIPTION: cURL could allow a remote attacker to obtain sensitive information, caused by ...

v7.beemray.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1100904 Security Researcher Tech4 Helped patch 33 vulnerabilities Received 1 Coordinated Disclosure badges Received 1 recommendations , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting v7.beemray.com website and its...

Easy2Pilot 7 Cross Site Request Forgery

==================================================================================================================================== | Title : Easy2Pilot V7 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | | Vendor :...

Information disclosure

An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover all previously used passwords on the device, for both the control panel and WEP/WPA/WPA2, in plaintext. This is a different issue than CVE-2012-6340...

Race condition

A vulnerability has been identified in SIMATIC S7-400 CPU 414-3 PN/DP V7, SIMATIC S7-400 CPU 414F-3 PN/DP V7, SIMATIC S7-400 CPU 416-3 PN/DP V7, SIMATIC S7-400 CPU 416F-3 PN/DP V7, Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, Development/Evaluation Kits for PROFIN...