PT-2020-16159 · Red Hat · Wildfly

Name of the Vulnerable Software and Affected Versions: WildFly versions up to 21.0.0.Final Description: A memory leak flaw was found in WildFly where the host-controller tries to reconnect in a loop, generating new connections that are not properly closed while unable to connect to the...

OpenJDK: Incomplete check for invalid characters in URI to path conversion (Libraries, 8242685)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multipl...

CVE-2020-14754

Vulnerability in the Oracle Solaris product of Oracle Systems component: Filesystem. The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successfu...

PT-2020-15522 · Jenkins · Jenkins Release Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Release Plugin versions 2.10.2 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because the release version in the badge tooltip is not properly escaped. Attackers with...

arekit (>=0.21.0 <=0.22.1), arenets (>=0.23.0 <=0.23.1) +164 more potentially affected by CVE-2020-15198 via tensorflow-gpu (>=1.10.1 <=2.3.0)

tensorflow-gpu PYPI version =1.10.1, =0.21.0, =0.23.0, =0.9.2, =0.1.0, =0.0.1, =0.1.0, =0.0.1, =1.0.0, =1.0.3 - cctv-analysis =0.0.2 - chatbot-nlu =1.0.0 - classitransformers =0.0.1 and more Source cves: CVE-2020-15198 Source advisory: OSV:PYSEC-2020-313...

mysql: C API unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client...

Openfire < 4.5.2 Multiple XSS Vulnerabilities

Openfire is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

RUSTSEC-2020-0166 personnummer Input validation error

Swedish personal identity is in the form of YYMMDD-XXXX An issue arises from the regular expression allowing the first three digits in the last four digits of the personnummer to be 000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure...

PT-2020-13523 · Mosca · Moscajs Aedes

Name of the Vulnerable Software and Affected Versions: MoscaJS Aedes version 0.42.0 Description: An issue was discovered in the handling of exceptions during the writing of an invalid packet to a stream in lib/write.js. Recommendations: For version 0.42.0, update to version 0.42.1 to resolve the...

Tiki Wiki CMS Groupware < 21.2 XSS Vulnerability

Tiki Wiki CMS Groupware is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

chromium-browser: Use after free in ANGLE

Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

D-Link DAP-1522 Authentication Bypass Vulnerability

The D-Link DAP-1522 is a wireless access point product from AUO D-Link of Taiwan, China. A security vulnerability exists in version 1.4x of the D-Link DAP-1522 prior to 1.10b04Beta02. An attacker can exploit the vulnerability to bypass authentication and gain direct access to the application...

phpList < 3.5.5 Multiple Vulnerabilities

phpList is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phplist:phplist"; if description...

PT-2020-15427 · Jenkins · Jenkins Github Coverage Reporter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitHub Coverage Reporter Plugin versions 1.8 and earlier Jenkins GitHub Coverage Reporter Plugin versions 1.10 and earlier Description: The issue concerns the storage of secrets in plain text in the global configuration file on the...

DEBIAN-CVE-2020-14196

In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced...

ai.databand.azkaban:azkaban-common (=3.18.0), ai.databand.azkaban:azkaban-exec-server (=3.18.0) +4556 more potentially affected by CVE-2019-2692 via mysql:mysql-connector-java (>=3.0.10 <=8.0.15)

mysql:mysql-connector-java MAVEN version =3.0.10, =0.1.0, =4.1.3, =0.0.13, =1.13.3, =Finchley.SR2.SR1, =1.0.0, =0.0.3, =0.0.5 - at.molindo:molindo-mysql-collations-lib =0.1.0 - bd.ac.seu.erp:model =0.0.2 and more Source cves: CVE-2019-2692 Source advisory: OSV:GHSA-JCQ3-CPRP-M333...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2020-36772)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 5.0.0 through 5.0.1. An attacker can exploi...

Security Bulletin: IBM TNPM for Wireline is vulnarable to Cross Site Request Forgery(CSRF) and Cross Site Scripting(CSS)

Summary IBM TNPM for Wireline is vulnarable to Cross Site Request ForgeryCSRF and Cross Site ScriptingCSS . This has been addressed. Vulnerability Details Third Party Entry: PSIRT-ADV0016782 DESCRIPTION: CVSS Base score: 5.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Third Party...

PT-2020-14431 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax php pecl.php...

PT-2020-14082 · Global Radar · Global Radar Bsa Radar

Name of the Vulnerable Software and Affected Versions: Global RADAR BSA Radar versions 1.6.7234.24750 and earlier Description: The issue allows users to view local files on the web server by manipulating the FileName and FilePath parameters in the URL, or while using a proxy, potentially exposing...