PT-2020-20273 · Salesagility · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.10.23 SuiteCRM versions prior to 7.11.11 Description: The issue allows SQL Injection. Recommendations: For versions prior to 7.10.23, update to version 7.10.23 or later. For versions prior to 7.11.11, update to...

McAfee Agent Access Control Error Vulnerability

McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator antivirus management platform and managed products. An access control error vulnerability exists in the masvc.exe file in McAfee Agent versions prior to 5.6.4. A local...

Mozilla Firefox Memory Corruption Vulnerability (CNVD-2020-18408)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 73. An attacker can exploit the vulnerability to corrupt memory, elevate privileges or possibly execute arbitrary code...

Palo Alto Networks PAN-OS Operating System Command Injection Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. An operating system command injection vulnerability exists in the CLI in Palo Alto Networks PAN-OS versions prior to 8.1.13. A local attacker could use this vulnerability to bypass a...

UBUNTU-CVE-2020-6815

Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corruption or escalation of privilege and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affec...

CVE-2020-7579

A vulnerability has been identified in Spectrum Power™ 5 All versions v5.50 HF02. The web server could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. If deployed according to...

Unspecified Vulnerability in Apple iOS and iPadOS Messages Component

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices. apple iPadOS is an operating system for iPad tablets. messages is one of the components of the application used to send text, photos, and videos. A security vulnerability exis...

TestLink SQL Injection Vulnerability (CNVD-2020-16091)

TestLink is a set of open source software for managing the software testing process and providing statistical analysis. A SQL injection vulnerability exists in TestLink 1.9.19 and earlier versions. The vulnerability stems from a lack of validation of externally entered SQL statements in...

Pricing Table by Supsystic Cross-Site Request Forgery Vulnerability

WordPress plugin Pricing Table by Supsystic is used to create pricing tables easily. A cross-site request forgery vulnerability exists in Pricing Table by Supsystic versions prior to 1.8.2. No details of the vulnerability are provided at this time...

Dropwizard-Validation Injection Vulnerability

Dropwizard is a Java framework for the development of easy to operate , high-performance RESTful web services . An injection vulnerability exists in Dropwizard-Validation versions prior to 1.3.19 and prior to 2.0.2. The vulnerability arises when a web system or product lacks proper validation of...

CloudBees Jenkins FitNesse plugin code issue vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A code issue vulnerability...

Cisco Data Center Network Manager Cross-Site Scripting Vulnerability (CNVD-2020-13203)

Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. A stored cross-site scripting vulnerability exists in the Web management interface...

Cisco Finesse Cross-Site Scripting Vulnerability (CNVD-2020-10505)

Cisco Finesse is a next-generation seat and supervisor desktop designed to provide a collaborative experience for the diverse communities that interact with your customer service organization. A cross-site scripting vulnerability exists in the Web management interface of Cisco Finesse versions...

UBUNTU-CVE-2016-1000109

HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic t...

rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to...

Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

Zimbra Collaboration Suite ZCS is a collaboration software suite that includes an email server and web client. A security vulnerability exists in Zimbra Collaboration Suite ZCS versions prior to 8.8.15 Patch 7. The vulnerability stems from an improperly designed or implemented code development...

Mozilla Thunderbird Denial of Service Vulnerability (CNVD-2020-13860)

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. A security vulnerability exists in the MIME handling code in Mozilla Thunderbird versions...

Google Chrome Content Security Policy Bypass Vulnerability (CNVD-2020-10252)

Chrome is a web browsing tool developed by Google. A content security policy bypass vulnerability exists in Google Chrome versions prior to 80.0.3987.87. The vulnerability stems from insufficient validation of untrusted input by Blink in Chrome. An attacker can exploit the vulnerability to bypass...

Mozilla Thunderbird Buffer Overflow Vulnerability

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. A buffer overflow vulnerability exists in Mozilla Thunderbird versions prior to 68.5. The...

Foxit Reader Out-of-Bounds Write Remote Code Execution Vulnerability (CNVD-2020-10620)

Foxit Reader old name: Foxit PDF Reader is a set of software used to read PDF format files, by Fujian Foxit Software developed by Foxit Reader is a set of free to use the software, the operating system is mainly based on Microsoft Windows, and as long as there is a Win32 implementation of the...