jackson-databind: Lacks certain xbean-reflect/JNDI blocking

A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availabili...

CVE-2020-2826

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite component: Print Server. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One...

org.sonatype.nexus.assemblies:nexus-base-feature (>=3.10.0-04 <=3.21.1-01), org.sonatype.nexus.assemblies:nexus-base-template (>=3.10.0-04 <=3.21.1-01) +33 more potentially affected by CVE-2020-10199 via org.sonatype.nexus:nexus-extdirect (>=3.10.0-04 <=3.21.1-01)

org.sonatype.nexus:nexus-extdirect MAVEN version =3.10.0-04, =3.10.0-04, =3.10.0-04, =3.21.0-01, =3.12.0-01, =3.10.0-04, =3.12.0-01, =3.10.0-04, =3.17.0-01, =0.0.1, =0.0.2, =0.0.3, =0.0.4, =0.0.13, =1.0.3 and more Source cves: CVE-2020-10199 Source advisory:...

dpd-paypal-ap (>=0.0.1 <=0.0.9), paypal-pay (=0.1.1) potentially affected by CVE-2020-7643 via paypal-adaptive (>=0.1.1 <=0.4.2)

paypal-adaptive NPM version =0.1.1, =0.0.1, =0.0.9 - paypal-pay =0.1.1 Source cves: CVE-2020-7643 Source advisory: SNYK:JS-PAYPALADAPTIVE-565089...

auth0.js Information Disclosure Vulnerability

auth0.js is a client-side JavaScript toolkit for the Auth0 API Application Programming Interface. A security vulnerability exists in auth0.js NPM package auth0-js versions 8.0.0 through 9.13.1. An attacker can exploit the vulnerability to obtain a password...

CVE-2020-4291

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176334...

CVE-2020-4164

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be used in further attacks against the system. IBM X-Force ID: 174400...

PT-2020-12466 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 9.0 through 12.9 Description: The issue allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project. Recommendations: For GitLab EE/CE versions 9.0 through 12.9, consider...

CVE-2016-11026

An issue was discovered on Samsung mobile devices with KK4.4, L5.0/5.1, and M6.0 software. BootReceiver allows attackers to trigger a system crash because of incorrect exception handling. The Samsung ID is SVE-2016-7118 December 2016...

CVE-2020-4303

IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Apache HTTP Server Uninitialized Memory Vulnerability

Apache HTTP Server is the United States Apache Software Apache Software Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.41, which stems from modproxyft...

AZL-44904 CVE-2019-11254 affecting package delve 1.5.0-16

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML...

PT-2020-2798 · Sds · Sds

Name of the Vulnerable Software and Affected Versions: sds versions 0.0.0 through 3.2.0 Description: The issue is related to Prototype Pollution, where the library can be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. This is...

IBM Spectrum Protect Plus Command Execution Vulnerability (CNVD-2020-20699)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Command Execution Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

F5 BIG-IP Buffer Error Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in F5 BIG-IP versions 12.1.0 through 12.1.5. An attacker can exploit the vulnerability to caus...

GitLab EE Path Traversal Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A path traversal vulnerability exists in the NPM feature ...

com.agorapulse:micronaut-snitch (>=0.1.2 <=1.1.3), io.github.oleksivio.tl.kbot:micronaut (=1.6.0) +14 more potentially affected by CVE-2020-7611 via io.micronaut:micronaut-http-client (>=1.0.0 <=1.2.10)

io.micronaut:micronaut-http-client MAVEN version =1.0.0, =0.1.2, =1.4.0, =1.1.0, =1.0.0, =1.0.0, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.19, =1.2.19, =1.0.3, =1.3.1 and more Source cves: CVE-2020-7611 Source advisory: SNYK:JAVA-IOMICRONAUT-561342...

2vyper (=0.3.0), black-mamba (>=0.1.0 <=0.3.0) +1 more potentially affected by unknown CVE via vyper (>=0.1.0b12 <=0.1.0b16)

vyper PYPI version =0.1.0b12, =0.1.0, =1.4.0, =1.6.7 Source cves: unknown CVE Source advisory: OSV:GHSA-MR6R-MVW4-736G...

com.akolov:doorman-core_2.12 (=0.0.5), com.avast:scala-server-toolkit-http4s-blaze-server_2.12 (=0.1.3) +55 more potentially affected by CVE-2020-5280 via org.http4s:http4s-server_2.12 (>=0.19.0 <=0.20.2)

org.http4s:http4s-server2.12 MAVEN version =0.19.0, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.16, =0.0.13, =0.0.13, =0.0.13, =0.0.13, =0.17.0, =0.18.1 - com.github.allantl:atlassian-connect-http4s2.12 =0.0.1 and more Source cves: CVE-2020-5280 Source advisory: OSV:GHSA-66Q9-F7FF-MMX6...