Design/Logic Flaw

PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times...

PT-2022-5613 · Freerdp +9 · Freerdp +9

Name of the Vulnerable Software and Affected Versions: FreeRDP versions prior to 2.9.0 Description: The issue is related to a lack of input length validation in the drive channel of the FreeRDP protocol implementation. This can be exploited by a malicious server to trick a FreeRDP-based client in...

GHSA-54CH-GJQ5-4976 Segfault due to missing support for quantized types

Impact There is a potential for segfault / denial of service in TensorFlow by calling tf.compat.v1. ops which don't yet have support for quantized types added after migration to TF 2.x: python import numpy as np import tensorflow as tf...

PT-2022-19447

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.9.0 TensorFlow versions prior to 2.8.1 TensorFlow versions prior to 2.7.2 TensorFlow versions prior to 2.6.4 Description The implementation of tf.raw ops.StagePeek does not fully validate the input arguments,...

NavigateCMS Access Control Error Vulnerability

NavigateCMS is a content management system. An access control error vulnerability exists in version 2.9 of NavigateCMS, which stems from the fact that the ID in the product/navigate/navigatedownload.php file does not properly validate the data entered. An attacker could exploit this vulnerability...

libsepol security update

2.9-3 - cil: Fix out-of-bound read of file context pattern ending with '' - cil: Destroy classperms list when resetting classpermission 1983517 - cil: Destroy classperm list when resetting map perms 1983521 - cil: cilresetclasspermsset should not reset classpermission 1983525 - cil: Set class...

Navigate CMS Cross-Site Scripting Vulnerability (CNVD-2021-57428)

A cross-site scripting vulnerability exists in Navigate CMS version 2.9, which is a powerful and intuitive content management system. The vulnerability can be exploited to conduct cross-site scripting attacks via the name="wrongpathredirect" function...

Navigate CMS Cross-Site Scripting Vulnerability (CNVD-2021-57427)

Navigate CMS, a powerful and intuitive content management system, is vulnerable to a cross-site scripting vulnerability in Navigate CMS version 2.9. The vulnerability can be exploited to conduct cross-site scripting attacks via the "Create" or "Edit" function of the "Tools" feature...

CVE-2020-23243

Cross Site Scripting XSS vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrongpathredirect" feature...

NavigateCMS和NavigateCMS 跨站脚本漏洞

Navigate CMS, a powerful and intuitive content management system, is vulnerable to a cross-site scripting vulnerability in Navigate CMS version 2.9. The vulnerability can be exploited to conduct cross-site scripting attacks via the "Create" or "Edit" function of the "Tools" feature...

Navigate CMS SQL Injection Vulnerability

Navigate CMS is a powerful and intuitive content management system. A SQL injection vulnerability exists in Navigate CMS version 2.9. The vulnerability can be exploited to conduct SQL injection attacks via URL-encoded GET input categories in navigate.php...

NavigateCMS SQL注入漏洞

Navigate CMS is a powerful and intuitive content management system. A SQL injection vulnerability exists in Navigate CMS version 2.9. The vulnerability can be exploited to conduct SQL injection attacks via URL-encoded GET input categories in navigate.php...

WordPress Login Protection – Limit Failed Login Attempts plugin <= 2.8 - Arbitrary Plugin Installation and Activation vulnerability

Arbitrary Plugin Installation and Activation vulnerability discovered by Bugbang in WordPress Login Protection – Limit Failed Login Attempts plugin versions = 2.8. Solution Update the WordPress Login Protection – Limit Failed Login Attempts plugin to the latest available version at least 2.9...

SUSE: Security Advisory (SUSE-SU-2020:3380-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2020-17384 · Bigprof · Bigprof Online Invoicing System

Name of the Vulnerable Software and Affected Versions: BigProf Online Invoicing System versions prior to 2.9 Description: The issue is related to an unauthenticated SQL Injection in the /membership passwordReset.php endpoint, which is used for self-service password resets. An attacker can send a...

Naviwebs Navigate CMS Cross-Site Scripting Vulnerability (CNVD-2020-35976)

Naviwebs Navigate CMS is an open source content management system CMS from Naviwebs, Inc. in the United States. A cross-site scripting vulnerability exists in the query parameter 'fid' in the navigation.php file in Naviwebs Navigate CMS version 2.9 r1433. The vulnerability stems from the WEB...

CVE-2020-14014

An issue was discovered in Navigate CMS 2.8 and 2.9 r1433. The query parameter fid on the resource navigate.php does not perform sufficient data validation and/or encoding, making it vulnerable to reflected XSS...

Information disclosure

Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting unauthorized information disclosure...

PT-2020-6568

Name of the Vulnerable Software and Affected Versions Ansible Engine versions 2.7.x through 2.7.16 Ansible Engine versions 2.8.x through 2.8.10 Ansible Engine versions 2.9.x through 2.9.6 Ansible Tower versions 3.4.5 and earlier Ansible Tower versions 3.5.5 and earlier Ansible Tower version 3.6.3...

GHSA-JJJR-3JCW-F8V6 Potential Observable Timing Discrepancy in Wagtail

Impact A potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this...