CVE-2020-13156

modules\users\admin\adduser.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=useradd URI...

CVE-2020-7262

Improper Access Control vulnerability in McAfee Advanced Threat Defense ATD prior to 4.10.0 allows local users to view sensitive files via a carefully crafted HTTP request parameter...

Mattermost Server Information Disclosure Vulnerability (CNVD-2020-48237)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.3.0, prior to 4.2.1, and prior to 4.1.2. An attacker could exploit the vulnerability to obtain the e-mail address of the team...

ALPINE-CVE-2020-14422

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface...

CVE-2020-11910

The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read...

Treck TCP/IP ICMPv4 Component Input Validation Error Vulnerability

Treck TCP/IP is a TCP Transmission Control Protocol/IP Internet Interconnection Protocol suite for embedded systems from Treck, Inc. Treck ICMPv4 stack is an ICMPv4 IPv4 Internet Control Message Protocol implementation for embedded systems from Treck, Inc. An input validation error vulnerability...

CVE-2020-6269

Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure...

UBUNTU-CVE-2020-13977

Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been...

QEMU Buffer Overflow Vulnerability (CNVD-2020-35975)

QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A buffer overflow vulnerability exists in the hw/pci/pci.c file in QEMU version 4.2.0. The vulnerability stems from a network...

Zoom Client Path Traversal Vulnerability (CNVD-2020-34131)

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A path traversal vulnerability exists in the way Zoom Client version 4.6.10 handles messages containing shared code segments. An attacker can exploit this vulnerability by sending a specially...

Stored XSS vulnerability in echarts-api

echarts-api 4.7.0-3 and earlier does not escape the parser identifier when rendering charts. This results in a stored cross-site scripting XSS vulnerability that can be exploited by users with Job/Configure permission. echarts-api 4.7.0-4 escapes the parser identifier...

snyk-broker information disclosure vulnerability (CNVD-2020-53548)

snyk-broker is a proxy program for access between snyk.io and Git repositories. An information disclosure vulnerability exists in snyk-broker versions prior to 4.80.0. An attacker can exploit this vulnerability by creating symbolic links matching whitelisted paths to read arbitrary files on the...

Arbitrary File Read

Overview snyk-broker is a package that proxies access between snyk.io and your Git repositories, such as GitHub Enterprise, GitHub.com and Bitbucket Server. Snyk Broker can also be used to enable a secure connection with your on-premise Jira deployment. Affected versions of this package are...

CVE-2019-19456

A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine = 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0...

Apache CloudStack Input Validation Error Vulnerability

Apache CloudStack is a set of Infrastructure as a Service IaaS cloud computing platforms from the Apache Software Apache Software Foundation in the United States. The platform is primarily used for deploying and managing large networks of virtual machines. A buffer overflow vulnerability exists i...

SAP Business Objects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2020-65699)

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. A cross-site scripting vulnerability exists in SAP Business Objects...

CVE-2020-6251

Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted...

DEBIAN-CVE-2020-12692

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times...

PYSEC-2020-56

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times...

Subrion CMS Authorization Issues Vulnerability

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. An authorization issue vulnerability exists in Subrion CMS version 4.2.1. The vulnerability stems from a lack of...