jackson-mapper-asl: XML external entity similar to CVE-2016-3720

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity XXE vulnerability affects codehaus's jackson-mapper-asl libraries. This vulnerability is similar to CVE-2016-3720. The primary threat from this flaw is data integrity...

Unspecified Vulnerability in CloudBees Jenkins Repository Connector Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Repository Connector Plugin is used in one of...

CVE-2020-25004

Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...

PT-2020-8914 · Pullit · Pullit

Name of the Vulnerable Software and Affected Versions: pullit versions prior to 1.4.0 Description: The issue allows OS Command Injection because eval is used on an attacker-supplied Git branch name. The package does not validate input on git branch names and concatenates it to an exec call,...

CVE-2020-24029

Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "corrected in all maintained versions. Password reset requests are validated...

CVE-2020-23830

A Cross-Site Request Forgery CSRF vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated victim's username when they visit a third-party site...

CloudBees Jenkins path traversal vulnerability (CNVD-2020-52604)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

USN-4480-1 keystone vulnerabilities

It was discovered that OpenStack Keystone incorrectly handled EC2 credentials. An authenticated attacker with a limited scope could possibly create EC2 credentials with escalated permissions. CVE-2020-12689, CVE-2020-12691 It was discovered that OpenStack Keystone incorrectly handled the list of...

PT-2020-15593 · Sourcecodester · Sourcecodester Tailor Management

Name of the Vulnerable Software and Affected Versions: SourceCodester Tailor Management System version 1.0 Description: A Reflected Cross-Site Scripting XSS issue in the index.php login-portal webpage allows remote attackers to harvest keys pressed by an unauthenticated victim who clicks on a...

CVE-2020-8720

Buffer overflow in a subsystem for some IntelR Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable denial of service via local access...

JetBrains Toolbox Data Forgery Issue Vulnerability

JetBrains Toolbox is a JetBrains product management application from the Czech company JetBrains. A security vulnerability exists in version 1.17 of JetBrains ToolBox prior to 1.17.6856. No details of the vulnerability are provided at this time...

CloudBees Jenkins Matrix Project Plugin Cross-Site Scripting Vulnerability (CNVD-2020-43166)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Matrix Project Plugin is used in one of the...

CVE-2020-7206

HP nagios plugin for iLO nagios-plugins-hpilo v1.50 and earlier has a php code injection vulnerability...

WebChess SQL Injection Vulnerability

WebChess is a web-based online chess game. A SQL injection vulnerability exists in WebChess version 1.0. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerability to execute illegal SQL command...

envoy: Resource exhaustion when proxying HTTP/2 requests or responses with small data frames

A flaw was found in Envoy in versions through 1.14.1. An excessive amount of memory may be consumed when proxying HTTP/2 requests and responses that contain many small e.g. 1 byte data frames. The highest threat from this vulnerability is to system availability...

CVE-2020-15037

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...

PT-2020-15435 · Jenkins · Jenkins Link Column Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Link Column Plugin versions 1.0 and earlier Description: The issue concerns a stored cross-site scripting vulnerability. It allows users with View/Configure permission to create links that can execute JavaScript code due to the lack o...

PT-2020-5910 · Phoenix Contact · Pc Worx Express +1

Name of the Vulnerable Software and Affected Versions: Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier Description: The issue is related to the parsing of PLCopen XML files in Phoenix Contact PC Worx and PC Worx Express, which can lead to a stack-based overflow due to...

Unspecified Vulnerability in Software- und Organisations-Service SOS JobScheduler

Software- und Organisations-Service SOS JobScheduler is a suite of open source, enterprise-class scheduling and process automation software from Software- und Organisations-Service, Germany. A security vulnerability exists in the JOE Job Editor component of Software- und Organisations-Service SOS...

jackson-mapper-asl: XML external entity similar to CVE-2016-3720

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity XXE vulnerability affects codehaus's jackson-mapper-asl libraries. This vulnerability is similar to CVE-2016-3720. The primary threat from this flaw is data integrity...