8585 matches found
Information Disclosure
ansible is vulnerable to information disclosure. The template caching generates identical values when consecutive facts are created from password lookup with same length. This causes the passwords for different fields to be exposed...
Information Disclosure
doorkeeper is susceptible to information disclosure. If it enables the Doorkeeper::Application attributes using the GET /oauth/authorizedapplications.json, an authorized application user can access the model attribute values including secrets...
Design/Logic Flaw
Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management all published versions enables an attacker authenticated on the local system to inject data, affecting the runtime values to be stored in the archive, or making Information Management...
Filter for custom field values shows all options from all contexts
h3. Summary If a custom field is added to a Portfolio plan, the Portfolio filter will show all options from all contexts configured in the custom field in Jira. h3. Steps to Reproduce Create a custom field with multiple contexts and values across contexts. Assign different projects to separate...
CVE-2020-12270: Use of Insufficiently Random Values
React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 contact tracing by using many IDs. NOTE: the vendor disputes the relevance of this report because the recipient of an F1 alert will know it...
How to Limit Parallel Disk Processing in Veeam Agent for Microsoft Windows
Purpose This article documents how to disable or limit parallel disk processing in Veeam Agent for Microsoft Windows. Solution The following registry values can used to control parallel disk processing on the machine where Veeam Agent for Microsoft Windows is installed: To disable parallel disk...
jQuery html() Cross Site Scripting
jquery-xss-in-html jQuery 3.5 Cross-Site Scripting XSS in html Timmy Willison recently released a new version of jQuery. jQuery 3.5 fixes a cross-site scripting XSS vulnerability found in the jQuery’s HTML parser. The Snyk open source security platform estimates that 84% of all websites may be...
CVE-2020-6828
A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference value...
Integer overflow
bson before 0.8 incorrectly uses int rather than sizet for many variables, parameters, and return values. In particular, the bsonensurespace parameter bytesNeeded could have an integer overflow via properly constructed bson input...
CVE-2020-12135
bson before 0.8 incorrectly uses int rather than sizet for many variables, parameters, and return values. In particular, the bsonensurespace parameter bytesNeeded could have an integer overflow via properly constructed bson input...
OpenConnect Input Validation Error Vulnerability
OpenConnect is an open source application for connecting to virtual private networks. A security vulnerability exists in OpenConnect 8.08 and earlier versions, which stems from the program failing to properly handle negative values returned by calls to the 'X509check' function. An attacker could...
CVE-2020-12105
OpenConnect through 8.08 mishandles negative return values from X509check function calls, which might assist attackers in performing man-in-the-middle attacks...
Input validation
OpenConnect through 8.08 mishandles negative return values from X509check function calls, which might assist attackers in performing man-in-the-middle attacks...
CVE-2020-12105
OpenConnect through 8.08 mishandles negative return values from X509check function calls, which might assist attackers in performing man-in-the-middle attacks...
PT-2020-6927 · Unknown +4 · Openconnect +4
Name of the Vulnerable Software and Affected Versions: OpenConnect versions prior to 8.08 Description: The issue is related to the mishandling of negative return values from X509 check function calls, which could assist attackers in performing man-in-the-middle attacks. This vulnerability is...
CVE-2020-12105: Improper Handling of Exceptional Conditions
OpenConnect through 8.08 mishandles negative return values from X509check function calls, which might assist attackers in performing man-in-the-middle attacks...
CVE-2020-11877: Use of Insufficiently Random Values
airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector IV for AES-256 CBC encryption. NOTE: the vendor states that this IV is used only within unreachable code...
Description of the security update for SharePoint Server 2019: April 14, 2020
None None...
CVE-2019-1866
Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the application. The vulnerability is due to improper validation of host header values. An attacker with a privileged network position, either a...
Letter from the CEO: A time of kindness and compassion
Dear Customers, Together, we are facing a truly unprecedented situation and we have all had to adapt to the new reality. The global coronavirus pandemic is affecting our families, our communities, our organizations – indeed, it affects our perspective and way of life. As you certainly have too, a...