CVE-2020-26551

An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file...

Design/Logic Flaw

Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...

CVE-2020-26551: Cleartext Storage of Sensitive Information

An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file...

CVE-2020-13351: Incorrect Default Permissions

Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...

CVE-2020-26550: Use of Insufficiently Random Values

An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated systems is protected by a three-character key...

PT-2020-13492 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.0 through 13.3.9 GitLab CE/EE versions 13.4.0 through 13.4.5 GitLab CE/EE versions 13.5.0 through 13.5.2 Description: Insufficient permission checks in the scheduled pipeline API allow an attacker to read variable nam...

PT-2020-16454

Name of the Vulnerable Software and Affected Versions Aviatrix Controller versions prior to R5.3.1151 Description An issue was discovered where encrypted key values are stored in a readable file. Recommendations For Aviatrix Controller versions prior to R5.3.1151, update to version R5.3.1151 or...

Authorization

IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The...

Denial Of Service (DoS)

linux kernel is vulnerable to denial of service. An out-of-bounds error in scalar32minmaxor in kernel/bpf/verifier.c during the use of 64-bit values allows an attacker to crash the kernel...

Exploit for Use of Insufficiently Random Values in Linux Linux_Kernel

CVE-2020-25705 PoC for CVE-2020-2...

Oracle Linux 7 : python3 (ELSA-2020-5010)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5010 advisory. - Avoid infinite loop when reading specially crafted TAR files CVE-2019-20907 Resolves: rhbz1856481 Tenable has extracted the preceding description blo...

Exploit for CVE-2020-1472

PoC exploit for CVE-2020-1472, a Windows Kerberos authentication...

IBM FileNet Content Manager CSV Injection Vulnerability

IBM FileNet Content Manager is a comprehensive enterprise content management ECM solution that uniquely combines content management with out-of-the-box workflow processes to help organizations manage complex documents and control, share and quickly access critical business information. A CSV...

CVE-2020-4759

IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 188736...

CVE-2020-27977

CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempts to edit registry values, allowing an attacker to escalate privileges...

PT-2020-16884

Name of the Vulnerable Software and Affected Versions CapaSystems CapaInstaller versions prior to 6.0.101 Description The issue allows an attacker to escalate privileges due to improper assignment, modification, or checking of privileges for an actor attempting to edit registry values...

CVE-2020-27977: Undefined Security Weakness

CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempts to edit registry values, allowing an attacker to escalate privileges...

CVE-2020-25398

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality...

Huawei EulerOS: Security Advisory for python-ipaddress (EulerOS-SA-2020-2472)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-22275

Easy Registration Forms ER Forms Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable...