VulnCheck KEV: CVE-2019-0232

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by...

PYSEC-2021-58

sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from oth...

CVE-2021-22311

There is an improper permission assignment vulnerability in Huawei ManageOne product. Due to improper security hardening, the process can run with a higher privilege. Successful exploit could allow certain users to do certain operations with improper permissions. Affected product versions include...

SQL Injection Vulnerability in One Zero Technology's Website Building System

Zero-One Technology Ren is a business intelligence solutions provider that integrates consulting, professional services and product marketing. A SQL injection vulnerability exists in the website building system of ZeroOne Technology, which can be exploited by attackers to obtain sensitive...

Katy Voor HHVM 缓冲区错误漏洞

Katy Voor HHVM is an open source application by Katy Voor. Provides an open source virtual machine designed to execute programs written in Hack. A security vulnerability exists in HHVM that stems from a write out-of-bounds if a buffer is full. The following products and versions are affected: HHV...

OPENSUSE-SU-2021:0397-1 Security update for mbedtls

This update for mbedtls fixes the following issues: - mbedtls was updated to version 2.16.9 - CVE-2020-10932: Fixed side channel in ECC code that allowed an adversary with access to precise enough timing and memory access information typically an untrusted operating system attacking a secure...

CVE-2020-11204

creationtimestamp| type| source ---|---|--- 2021-03-03 04:59:01+00:00| seen| https://t.me/cKure/4155 2026-01-20 08:04:57+00:00| seen| https://infosec.exchange/users/certvde/statuses/115926387351405846...

CVE-2020-24455

Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4.3...

Stored XSS vulnerability in artifact-repository-parameter

artifact-repository-parameter 1.0.0 and earlier does not escape parameter names and descriptions. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. artifact-repository-parameter 1.0.1 escapes parameter names and descriptions...

Shenzhen Zero-One Information Technology Co., Ltd. website building system SQL injection vulnerability

Shenzhen Zero-One Information Technology Co., Ltd. is a business intelligence solution provider integrating consulting, professional services and product marketing. There is a SQL injection vulnerability in the website building system of Shenzhen Zero One Information Technology Co. Attackers can...

CVE-2020-1723

A flaw was found in Keycloak Gatekeeper Louketo. The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. Affected versions of Keycloak Gatekeeper Louketo: 6.0.1, 7.0.0...

OpenEMR 代码问题漏洞

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A remote code execution vulnerability exists in OpenEMR 5.0.1. An attacker can exploit this vulnerability to upload and execute malicious PHP scripts via /controller.php...

Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 (KB4598501)

Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 KB4598501 Applies to: Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1 Microsoft .NET Framework 4.6.2...

IBM Security Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2020-73012)

IBM Security Key Lifecycle Manager formerly known as Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. An information disclosure vulnerabili...

CVE-2020-4845

IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

Adobe Prelude 代码问题漏洞

Adobe Prelude is a video recording and capture tool designed for intuitive and efficient media organization and metadata entry, quickly tagging and transcoding video footage and creating rough cuts on the fly. An uncontrolled search path vulnerability exists in Adobe Prelude 9.0.1 and earlier...

PT-2020-8126

Name of the Vulnerable Software and Affected Versions: Crafter Studio version 3.0.1 Description: A directory traversal vulnerability exists in Crafter Studio, allowing unauthenticated attackers to overwrite files from the operating system, which can lead to remote code execution RCE...

HCL Domino Denial of Service Vulnerability (CNVD-2020-66308)

HCL Domino is a server for collaborative client-server software platforms. A denial of service vulnerability exists in HCL Domino versions 9.0.1 FP10 IF6, prior to 10.0.1. The vulnerability stems from improper validation of user-supplied input. An attacker could exploit the vulnerability to cause...

HCL Domino Denial of Service Vulnerability

HCL Domino is a server for collaborative client-server software platforms. A denial of service vulnerability exists in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP5, and prior to 11.0.1. The vulnerability stems from improper validation of user-supplied input. A remote, unauthenticated attacker...

HCL Technologies Domino 输入验证错误漏洞

HCL Domino is a server for collaborative client-server software platforms. A denial of service vulnerability exists in HCL Domino versions 9.0.1 FP10 IF6, prior to 10.0.1. The vulnerability stems from improper validation of user-supplied input. An attacker could exploit the vulnerability to cause...