PT-2020-6290 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.3.4 and earlier Magento versions 2.2.11 and earlier Magento version 1.14.4.4 and earlier Magento version 1.9.4.4 and earlier Description: The issue is related to a command injection vulnerability. It could allow a remote...

Rukovoditel Cross-Site Scripting Vulnerability (CNVD-2020-26655)

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . A cross-site scripting vulnerability exists in the User Access Groups page of the Application Structure...

CVE-2020-11821

In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply brute force on them...

ALPINE-CVE-2020-11810

An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 PDATAV2 packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be...

PT-2020-10763 · Trustwave +1 · Opendmarc +1

Name of the Vulnerable Software and Affected Versions: OpenDMARC versions 1.3.2 and 1.4.x Description: The issue allows attacks to bypass SPF and DMARC authentication when the HELO field is inconsistent with the MAIL FROM field, specifically when OpenDMARC is used with pypolicyd-spf 2.0.2...

PT-2020-12481 · Percona · Percona Xtrabackup

Name of the Vulnerable Software and Affected Versions: Percona XtraBackup versions prior to 2.4.20 Description: The issue allows sensitive information to be unintentionally written to backup files and the PERCONA SCHEMA.xtrabackup history table when the --history option is used. This may include...

CVE-2017-18765

Certain NETGEAR devices are affected by denial of service. This affects R6300v2 before 1.0.4.8, R6400 before 1.0.1.22, R6400v2 before 1.0.2.32, R6700 before 1.0.1.20, R6900 before 1.0.1.20, WNR3500Lv2 before 1.2.0.44, and WNR2000v2 before 1.2.0.8...

Net new PHP enterprise website management system standard version (with mobile version) v2.6 exists arbitrary file deletion vulnerability

Netnew PHP enterprise website management system standard version with mobile version is developed using PHP + MYSQL technology and MVC mode, with clear architecture and easy-to-maintain code. Netnew PHP Enterprise Website Management System Standard Edition with Mobile Version v2.6 has an arbitrar...

Rukovoditel SQL Injection Vulnerability (CNVD-2020-26656)

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . A SQL injection vulnerability exists in Rukovoditel version 2.5.2. The vulnerability stems from a lack ...

Rukovoditel Code Issue Vulnerability

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . A security vulnerability exists in Rukovoditel version 2.5.2. An attacker can change the content-type...

CVE-2020-11820

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entitiesid parameter...

Western Digital My Cloud Home and ibi Websites Clickjacking Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud Home and ibi Websites versions prior to 2.2.0. An attacker could exploit the vulnerability to hijack click-through actions on the login page...

Unspecified Vulnerability in Oracle Java SE Advanced Management Console Component

Oracle Java SE is a U.S. Oracle Oracle company for the development and deployment of desktop, server and embedded devices and real-time environments in the Java application. A security vulnerability exists in the Advanced Management Console component of Oracle Java SE, version 2.16. An attacker...

CVE-2019-20664

Certain NETGEAR devices are affected by stored XSS. This affects RBR20 before 2.3.5.26, RBS20 before 2.3.5.26, RBK20 before 2.3.5.26, RBR40 before 2.3.5.30, RBS40 before 2.3.5.30, RBK40 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, and RBK50 before 2.3.5.30...

CVE-2020-10382

An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an authenticated remote code execution in the backup-scheduler...

HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

PT-2020-6213 · Openexr +5 · Openexr +5

Name of the Vulnerable Software and Affected Versions: OpenEXR versions prior to 2.4.1 Description: An issue in OpenEXR is related to an off-by-one error in the use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read. This could potentially all...

Unspecified vulnerability exists in docker-kong

docker-kong is an API3 gateway product used in the Docker application container engine. A security vulnerability exists in docker-kong for Kong version 2.0.3 and earlier, which can be exploited by an attacker to access the admin API port on interfaces other than 127.0.0.1...

Varnish Cache Input Validation Error Vulnerability

Varnish Cache is a set of reverse web caching servers. An input validation error vulnerability exists in Varnish Cache that stems from communication with a TLS proxy using the PROXY v2 version of the protocol. An attacker can exploit this vulnerability to cause assertion failures and daemon...

Plat'Home EasyBlocks IPv6 Authorization Issues Vulnerability

Plat'Home EasyBlocks IPv6 is an IPv6 address set allocation unit product from Plat'Home Japan. An authorization issue vulnerability exists in Plat'Home EasyBlocks IPv6 version 2.0.1 and earlier Enterprise Edition and version 2.0.1 and earlier. The vulnerability can be exploited by an attacker to...