4738 matches found
IBM Security Key Lifecycle Manager Account Issue Vulnerability
IBM Security Key Lifecycle Manager Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. An account issue vulnerability exists in IBM Security K...
CVE-2020-4573
IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests. IBM X-Force ID: 184180...
EOS.IO DAWN Security Vulnerability
EOS.IO DAWN is a smart contract platform based on blockchain technology. The platform is used to deploy decentralized applications.A security vulnerability exists in EOS.IO DAWN version 4.2, which stems from the plugins/netplugin/netplugin.cpp file not limiting the number of P2P links from the sa...
Munkireport comment cross-site scripting vulnerability
Munkireport is a reporting tool for the Munki software management program. comment is one of the comment modules. A cross-site scripting vulnerability exists in MunkiReport for comments prior to version 4.0. A remote attacker can exploit this vulnerability by posting a new comment to inject...
openstack-keystone: failure to check signature TTL of the EC2 credential auth method
A flaw was found in Keystone, where the restriction was not checked for the Signature Version 4 V4 process of AWS signatures issued within a limited time window. This flaw allows an attacker to capture an auth header and reuse it, potentially maintaining indefinite access...
SAP Business Objects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2020-41879)
SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. A cross-site scripting vulnerability exists in SAP Business Objects...
CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
CVE-2020-6281
SAP Business Objects Business Intelligence Platform BI Launchpad, version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting...
UBUNTU-CVE-2020-10756
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6sendechoreply routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory,...
Xen competitive conditions loophole
Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in Xen 4.13....
ALPINE-CVE-2020-15563
An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HV...
CVE-2020-14166
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting XSS vulnerability by uploading a html file...
Squid Code Problem Vulnerability
Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in Squid versions prior to 4.12 and 5.x versions prior to 5.0.3. An attacker could...
OPENSUSE-SU-2020:0914-1 Security update for squid
This update for squid fixes the following issues: squid was updated to version 4.12 Security issue fixed: - CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake bsc1173304. Other issues addressed: - Reverted to slow search for new SMP s...
openstack-keystone: failure to check signature TTL of the EC2 credential auth method
A flaw was found in Keystone, where the restriction was not checked for the Signature Version 4 V4 process of AWS signatures issued within a limited time window. This flaw allows an attacker to capture an auth header and reuse it, potentially maintaining indefinite access...
CVE-2020-13156
modules\users\admin\adduser.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=useradd URI...
CVE-2020-7262
Improper Access Control vulnerability in McAfee Advanced Threat Defense ATD prior to 4.10.0 allows local users to view sensitive files via a carefully crafted HTTP request parameter...
Mattermost Server Information Disclosure Vulnerability (CNVD-2020-48237)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.3.0, prior to 4.2.1, and prior to 4.1.2. An attacker could exploit the vulnerability to obtain the e-mail address of the team...
ALPINE-CVE-2020-14422
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface...