1646 matches found
Unspecified Vulnerability in Oracle MySQL Client (CNVD-2021-04752)
Oracle MySQL is an open source relational database management system.MySQL Client is a MySQL client, a program used to communicate with a server to process information in a database managed by the server. An unspecified vulnerability exists in the C API component in Oracle MySQL Client versions...
Unspecified Vulnerability in Oracle MySQL Client (CNVD-2021-04753)
Oracle MySQL is an open source relational database management system.MySQL Client is a MySQL client, a program used to communicate with a server to process information in a database managed by the server. An unspecified vulnerability exists in the C API component in Oracle MySQL Client versions...
Oracle MySQL 安全漏洞
Oracle MySQL is an open source relational database management system.MySQL Client is a MySQL client, a program used to communicate with a server to process information in a database managed by the server. An unspecified vulnerability exists in the C API component of Oracle MySQL Client 8.0.19 and...
Oracle MySQL 安全漏洞
Oracle MySQL is an open source relational database management system.MySQL Client is a MySQL client, a program used to communicate with a server to process information in a database managed by the server. An unspecified vulnerability exists in the C API component in Oracle MySQL Client versions...
Rust Competition Condition Problem Vulnerability
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust lockapi crate before 0.4.2, which stems from an unsound MappedRwLockReadGuard and may allow data contention...
CVE-2020-35586
Solstice Pod (before 3.3.0) and Solstice Open4.3 vulnerability where the Administrator password can be enumerated by brute-forcing the Open Control API endpoint /Config/service/initModel?password= due to no password complexity requirements. Affected products are Solstice Pod prior to 3.3.0 and So...
CVE-2020-35585
CVE-2020-35585 affects Solstice Pod before 3.3.0 (or Open4.3). A brute‑force enumeration flaw enables guessing the screen key via the /lookin/info Solstice Open Control API, with only ~1.7 million possibilities. This is the vulnerability described in the CVE; the connected documents confirm the A...
mysql: C API unspecified vulnerability (CPU Jan 2020)
Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...
mysql: C API unspecified vulnerability (CPU Apr 2020)
Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise...
WHO COVID-19 Mobile App: Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify Users
Summary: Note: I noticed that that the team has fixed issues like an XSS that's caused only from a header value typically OOS since it's not directly exploitable https://github.com/WorldHealthOrganization/app/pull/855, so in the spirit of this I'm also reporting another "good-to-fix" issue. On th...
CVE-2020-27147
The REST API component of TIBCO Software Inc.'s TIBCO PartnerExpress contains a vulnerability that theoretically allows an unauthenticated attacker with network access to obtain an authenticated login URL for the affected system via a REST API. Affected releases are TIBCO Software Inc.'s TIBCO...
M/Monit 3.7.4 - Password Disclosure
Title: M/Monit 3.7.4 - Password Disclosure Author: Dolev Farhi Date: 2020-07-09 Vendor Homepage: https://mmonit.com/ Version : 3.7.4 import sys import requests url = 'http://youriphere:8080' username = 'test' password = 'test123' sess = requests.Session sess.gethost def login: print'Attempting to...
CVE-2020-3392
A vulnerability in the API of Cisco IoT Field Network Director FND could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not properly authenticate API calls. An attacker could exploit this...
Information Exposure
Overview spreeapi is a Spree Api module Affected versions of this package are vulnerable to Information Exposure. An attacker can query the API v2 Order Status endpoint with an empty string passed as an Order token. Remediation Upgrade spreeapi to version 3.7.13, 4.0.5, 4.1.12 or higher. Referenc...
Authorization bypass in Spree
Impact The perpetrator could query the API v2 Order Status https://guides.spreecommerce.org/api/v2/storefronttag/Order-Status endpoint with an empty string passed as an Order token Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree 3.7 are not...
Design/Logic Flaw
A vulnerability in the video endpoint API xAPI of Cisco TelePresence Collaboration Endpoint CE Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper storage of sensitive information on an affected...
CVE-2020-27128 Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by...
PT-2020-4645 · Cisco · Cisco Sd-Wan Vmanage
Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: The issue is related to improper validation of directory traversal character sequences within requests to application programmatic interfaces APIs. This could allow an...