IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14212)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

ruby: DoS by large request in WEBrick

It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory...

CVE-2020-0694

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0693...

Microsoft Office SharePoint XSS Vulnerability

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

PT-2020-1737 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: A cross-site scripting issue exists due to improper sanitization of specially crafted web requests...

The vulnerability of the sub-component of the Infrastructure component of the Oracle FLEXCUBE Universal Banking banking analytics system, a simulation modeling application of Oracle Financial Services, allows a perpetrator to gain access to read data or modify data.

The vulnerability of the Infrastructure sub-component of the Oracle FLEXCUBE Universal Banking component, a banking analytics system for simulation-based modeling by Oracle Financial Services Applications, is related to the lack of protection for operational data. Exploiting this vulnerability...

CVE-2019-19825

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...

Microsoft ASP.NET Core Denial of Service Vulnerability (CNVD-2020-16652)

Microsoft ASP.NET Core is a framework of cross-platform open source framework from Microsoft. The framework is used to build cloud-based applications such as Web applications, Internet of Things applications, and mobile backends. A denial of service vulnerability exists in Microsoft ASP.NET Core...

CVE-2020-7241

The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 20200..10..20..30..9 format, guessing UNIX...

CVE-2020-2560

Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM component: SWSE Server. Supported versions that are affected are 19.10 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attac...

CVE-2020-0656

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 On-Premise Cross Site Scripting Vulnerability'...

Denial of service

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'...

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics...

PT-2020-1295 · Microsoft +2 · Asp.Net Core +2

Name of the Vulnerable Software and Affected Versions: ASP.NET Core affected versions not specified Description: A denial of service issue exists due to improper handling of web requests by ASP.NET Core. This can be exploited by a remote attacker to cause a denial of service by sending specially...

nginx 0.8.x < 0.8.33 / 0.7.x < 0.7.65 Windows Filename Pseudonyms (CORE-2010-0121)

The installed version of nginx is 0.7.52 and prior to 0.7.65, or 0.8.x prior to 0.8.33. It is, therefore, affected by a flaw in Windows installations of nginx. This is due to nginx mishandling DOS-compatible 8.3 short filenames. An unauthenticated, remote attacker can exploit this, via web...

The vulnerability of the microprogrammed Ethernet switch software from Moxa EDS-405A series, related to buffer overflow, allows a hacker to trigger a service failure.

The vulnerability of the microprogrammed Ethernet switch software from Moxa EDS-405A series is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure by sending HTTP GET requests to the vulnerable device...

The vulnerability of the microprogrammed Ethernet switch software from Moxa series EDS-405A lies in insufficient validation of input data, allowing a intruder to trigger a service failure.

The vulnerability of the microprogrammed Ethernet switch software from Moxa EDS-405A series exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending HTTP GET requests to the vulnerable device...

Cisco Data Center Network Manager serverinfo Hardcoded Password Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Data Center Network Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of web requests. The system contains a hard-cod...

The vulnerability of the McAfee Advanced Threat Defense software arises from the lack of measures taken to neutralize its special elements, allowing attackers to execute arbitrary commands.

The vulnerability of the McAfee Advanced Threat Defense security tool exists due to the failure to take measures to neutralize specific elements within it. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands by sending specially crafted HTTP...

The vulnerability of the “/absolute/pathname/here” component of the McAfee Advanced Threat Defense security tool, which allows a perpetrator to gain access to files in the local file system.

The vulnerability of the “/absolute/pathname/here” component of the McAfee Advanced Threat Defense security tool exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to...