Resourcexpress Meeting Monitor SQL Injection Vulnerability

Resourcexpress Meeting Monitor is a meeting booking software from Resourcexpress UK. It centralizes the management of meeting room screens and desk booking equipment to support rational meeting booking. A SQL injection vulnerability exists in Resourcexpress Meeting Monitor version 4.9, which stem...

CVE-2020-13877

SQL Injection issues in various ASPX pages of ResourceXpress Meeting Monitor 4.9 could lead to remote code execution and information disclosure...

CVE-2020-4650

IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023...

Code injection

IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023...

CVE-2020-4650

IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023...

CVE-2020-4650

Summary: CVE-2020-4650 affects IBM Maximo Spatial Asset Management 7.6.0.3/0.4/0.5/1.0 where web pages can be stored locally and read by another user on the same system. The core issue is a local storage exposure in the web component, enabling access to locally stored pages. The NVD entry notes a...

Security Bulletin: IBM Maximo Spatial Asset Management allows web pages to be stored locally which can be read by another user on the system (CVE-2020-4650)

Summary IBM Maximo Spatial Asset Management allows web pages to be stored locally which can be read by another user on the system. Vulnerability Details CVEID: CVE-2020-4650 DESCRIPTION: IBM Maximo Spatial Asset Management allows web pages to be stored locally which can be read by another user on...

UBUNTU-CVE-2020-27741

Multiple cross-site scripting XSS vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread...

UBUNTU-CVE-2020-27216

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub...

CVE-2020-27533

A Cross Site Scripting XSS issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages...

Cross site scripting

A Cross Site Scripting XSS issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages...

CVE-2020-27533

A Cross Site Scripting XSS issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages...

Information disclosure

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts loaded on the page. To take advantage of...

CVE-2020-16941

CVE-2020-16941 describes an information-disclosure vulnerability in Microsoft SharePoint Server where, on certain pages, the server improperly discloses the folder structure by revealing the folder path of scripts loaded on the page. An attacker must have access to the affected SharePoint page to...

CVE-2020-6365

SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicious site due to insufficient reverse tabnabbing URL validation. The attacker could execute phishing attacks to steal credentials of the...

CVE-2020-6319

SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal...

Microsoft SharePoint Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts loaded on the page. To take advantage of...

[SECURITY] Fedora 32 Update: php-7.4.11-1.fc32

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[SECURITY] Fedora 33 Update: rubygem-actionview-6.0.3.3-1.fc33

Simple, battle-tested conventions and helpers for building web pages...

[SECURITY] Fedora 33 Update: php-7.4.11-1.fc33

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...