2840 matches found
TuziCMS v3.0 do***_mb*** has command execution vulnerability
TuziCMS is an enterprise website management system based on ThinkPHP 3.2 framework. TuziCMS v3.0 domb has a command execution vulnerability that can be exploited by an attacker to gain control of the server...
Baxter PrismaFlex and PrismMax Information Disclosure Vulnerabilities
The Baxter PrismaFlex and PrismMax are both critical care devices from Baxter. An information disclosure vulnerability exists in Baxter PrismaFlex all versions and PrismMax prior to version 3.x. The vulnerability stems from the failure of an affected device to encrypt e.g., TLS/SSL transmitted da...
CVE-2020-1206
An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 SMBv3 protocol handles certain requests, aka 'Windows SMBv3 Client/Server Information Disclosure Vulnerability'...
DEBIAN-CVE-2019-20812
An issue was discovered in the Linux kernel before 5.4.7. The prbcalcretireblktmo function in net/packet/afpacket.c can result in a denial of service CPU consumption and soft lockup in a certain failure case involving TPACKETV3, aka CID-b43d1f9f7067...
PT-2020-15406 · Jenkins · Jenkins Self-Organizing Swarm Plug-In Modules Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Self-Organizing Swarm Plug-in Modules Plugin versions 3.20 and earlier Description: A cross-site request forgery issue allows attackers to add or remove agent labels. The Swarm Plugin adds API endpoints to manage agent labels, but in...
Mozilla Network Security Services Information Disclosure Vulnerability (CNVD-2020-39017)
Mozilla Network Security Services NSS is a library of functions Network Security Services library from the Mozilla Foundation in the United States. The product provides cross-platform support for SSL, S/MIME and other Internet security standards. A security vulnerability exists in Mozilla NSS...
Arbitrary Code Injection
Overview serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Arbitrary Code Injection. An object like "foo": /1"/, "bar": "a"@R--0@" would be serialized as "foo": /1"/,...
CVE-2020-12257
rConfig 3.9.4 is vulnerable to cross-site request forgery CSRF because it lacks implementation of CSRF protection such as a CSRF token. An attacker can leverage this vulnerability by creating a form add a user, delete a user, or edit a user...
DRUPAL-CONTRIB-2020-019
The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3. If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms. This vulnerability only affects forms that are...
WordPress Chop Slider SQL Injection Vulnerability
WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Chop Slider is a jQuery slider plugin used in it. A SQL injection vulnerability exists in the 'id' GET parameter of the...
Solis Gnuteca SQL Injection Vulnerability
Solis Gnuteca is a library management system from Solis Brazil. The system includes features such as e-mail alerts, automated inventory, location tracking and user registration. A SQL injection vulnerability exists in Solis Gnuteca version 3.8. The vulnerability stems from a database-based...
CVE-2020-12764
Gnuteca 3.8 allows file.php?folder=/&file= Directory Traversal...
McAfee Endpoint Detection and Response Privileging Vulnerability (CNVD-2020-35071)
McAfee Endpoint Detection and Response EDR is a suite of endpoint threat detection and response solutions from the U.S.-based company McAfee McAfee. The product supports threat event monitoring, host traffic monitoring and automatic threat identification and other functions. A power lifting...
CVE-2019-18871
A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution...
Ntop nDPI Input Validation Error Vulnerability
Ntop nDPI is an open source library for deep packet inspection from Ntop Italy. An input validation error vulnerability exists in the SSH protocol parser in Ntop nDPI 3.2 Stable and prior versions, which can be exploited by attackers to execute code or perform network traffic analysis...
ABB Telephone Gateway TG/S and Busch-Jaeger 6186/11 Telefon-Gateway Information Disclosure Vulnerability
The ABB Telephone Gateway TG/S and the Busch-Jaeger 6186/11 Telefon-Gateway are both a telephone gateway product from ABB Switzerland. A security vulnerability exists in ABB Telephone Gateway TG/S version 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway. The vulnerability stems from a lack of effecti...
CVE-2020-11826
Users can lock their notes with a password in Memono version 3.8. Thus, users needs to know a password to read notes. However, these notes are stored in a database without encryption and an attacker can read the password-protected notes without having the password. Notes are stored in the ZENTITY...
CVE-2020-6230
SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and lead to Code Injection. An attacker could thereby control the behavior of the application...
net-snmp: double free in usm_free_usmStateReference function in snmplib/snmpusm.c via an SNMPv3 GetBulk request
net-snmp before 5.8.1.pre1 has a double free in usmfreeusmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release...