2231 matches found
CVE-2019-4545
IBM QRadar SIEM 7.3 and 7.4 when configured to use Active Directory Authentication may be susceptible to spoofing attacks. IBM X-Force ID: 165877...
SpamTitan Code Injection Vulnerability
SpamTitan is an anti-spam solution from C/o Copperfasten, Ireland. The solution is characterized by easy installation and simple configuration. A code injection vulnerability exists in SpamTitan 7.07. The vulnerability stems from improper validation of the quid parameter in mailqueue.php. The...
Trustwave MailMarshal Operating System Command Injection Vulnerability
Trustwave MailMarshal is a suite of email security gateway products from Trustwave, Inc. An operating system command injection vulnerability exists in the STARTTLS implementation in Trustwave MailMarshal versions prior to 7.2. An attacker could exploit this vulnerability to execute arbitrary...
PT-2020-15384
Name of the Vulnerable Software and Affected Versions Gazie version 7.29 Description The issue allows for Cross Site Scripting XSS via the "http://192.168.100.7/gazie/modules/config/admin utente.php" endpoint, specifically through the user name variable. An attacker can inject JavaScript code,...
iCMS Cross-Site Request Forgery Vulnerability (CNVD-2020-54957)
iCMS is a content management system CMS built with PHP and MySQL databases. A cross-site request forgery vulnerability exists in iCMS v7.0.0. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker can exploit the...
CVE-2020-24739
A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account. When missing the CSRFTOKEN and can still request normally, all administrators except the initial administrator will be deleted...
openSIS SQL Injection Vulnerability (CNVD-2020-50952)
openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the login function in OS4Ed openSIS 7.3, which can be exploited by an attacker to conduct a SQL injection attack by sending a specially crafted HTTP request...
openSIS SQL Injection Vulnerability (CNVD-2020-50532)
openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the ln parameter in CheckDuplicateStudent.php in openSIS 7.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection attack...
CVE-2020-23450
Spiceworks Version = 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/inventory/groups/ without output sanitization...
CVE-2020-5540
Cross-site scripting vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to inject arbitrary script or HTML via a specially crafted URL...
Enterprise Search 7.9.0 security update
Enterprise Search credential exposure flaw ESA-2020-11 Elastic Enterprise Search versions before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the ‘developer’ role, they will be able to view the administrator API credentials. These credentials could allo...
IBM Maximo Asset Management Path Traversal Vulnerability (CNVD-2020-46262)
IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A path traversa...
IBM WebSphere Application Server Remote Code Execution Vulnerability
IBM WebSphere Application Server WAS is an application server product from IBM in the United States. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A remote code execution vulnerability exists in IBM WAS versions 7....
Multiple vulnerabilities in CyberMail
Overview CyberMail contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2020-5540 Open Redirect CWE-601 - CVE-2020-5541 Tony Kuo and Chia-Lung Hsieh of CHT Security reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...
PT-2020-15053 · Otrs +1 · Otrs Community Edition +2
Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions 6.0.28 and prior OTRS versions 7.0.18 and prior OTRS versions 8.0.4 and prior Description: The issue occurs when an agent user is renamed or set to invalid, and the session belonging to the user remains active...
IBM QRadar SIEM XML Entity Injection Vulnerability
IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A security...
CVE-2020-4512
IBM QRadar SIEM 7.3 and 7.4 could allow a remote privileged user to execute commands...
SAP Solution Manager Injection Vulnerability
SAP Solution Manager is a set of system monitoring, SAP support desktop, self-service, ASAP implementation and other functions of the German SAP company as one of the system management platform. The platform can help customers establish SAP solution lifecycle management, and provide system...
Cellebrite UFED Trust Management Issues Vulnerability (CNVD-2020-51755)
Cellebrite UFED is a universal forensic product from Cellebrite Israel. The product is mainly used for data extraction, transmission and analysis of devices. A security vulnerability exists in Cellebrite UFED versions 5.0 through 7.5.0.845. An attacker could exploit the vulnerability to access...