CVE-2020-6295

CVE-2020-6295 affects SAP Adaptive Server Enterprise 16.0. A vulnerability allows an attacker to access encrypted sensitive information through publicly readable installation log files, leading to a compromise of the Cockpit and potential information disclosure (view/modify/unavailable data). The...

Vulnerability fixed in Fedora kernel

A vulnerability has been fixed in the Fedora kernel. The vulnerability allows a local malicious person to access gain access to system data. Fedora has made updates available for Fedora 32. You can install these updates by using the 'dnf' or 'yum' command. More information about these updates and...

PT-2020-3834 · Microsoft · Windows Accounts Control +1

Name of the Vulnerable Software and Affected Versions: Windows Accounts Control affected versions not specified Description: The issue is related to an elevation of privilege vulnerability that occurs when the Windows Accounts Control improperly handles memory. To exploit this, an attacker must...

PT-2020-3811 · Microsoft · Windows Waasmedic Service +1

Name of the Vulnerable Software and Affected Versions: Windows WaasMedic Service affected versions not specified Description: An information disclosure issue exists due to improper memory handling by the Windows WaasMedic Service. To exploit this, an attacker must first gain execution on the vict...

Security Bulletin: Content Collector for Email is affected by a embedded WebSphere Application Server is vulnerable to Apache Commons beanutils

Summary Apache Commons Beanutils could allow a remote attacker to gain unauthorized access to the system, caused by the failure to suppresses the class property in bean introspection by default. An attacker could exploit this vulnerability to gain unauthorized access to the classloader...

grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process

A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access...

Design/Logic Flaw

An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may access the system's administration modem...

CVE-2020-9102

There is a information leak vulnerability in some Huawei products, and it could allow a local attacker to get information. The vulnerability is due to the improper management of the username. An attacker with the ability to access the device and cause the username information leak. Affected produ...

SAP Disclosure Management Code Issue Vulnerability

SAP Disclosure Management is an automated financial disclosure management system from SAP. The system provides a collaborative financial disclosure process across teams, geographies, systems and data sources. A code issue vulnerability exists in SAP Disclosure Management. An attacker could exploi...

Unspecified Vulnerability in Oracle VM VirtualBox (CNVD-2020-40796)

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The product is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...

Small CRM 'email' SQL Injection Vulnerability

Small CRM is a popular customer management system for small businesses. Small CRM 'email' SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2020-41755)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the MySQL Server 8.0.20 and prior versions of Server: Security: Privileges component of Oracle MySQL. An attacker...

Information disclosure

SAP NetWeaver - XML Toolkit for JAVA ENGINEAPI versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, under certain conditions allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure...

Mozilla: Automatic account setup leaks Microsoft Exchange login credentials

If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker. This...

Apache Tomcat Code Problem Vulnerability

Apache Tomcat is the United States Apache Apache Software Foundation, a lightweight Web application server. The program implements the Servlet and JavaServer Page JSP support. A security vulnerability exists in Apache Tomcat. An attacker could exploit the vulnerability to access or modify...

The vulnerability of the BN_mod_exp function (crypto/bn/asm/x86_64-mont5.pl) in the OpenSSL library, which allows a perpetrator to gain unauthorized access to confidential data

The vulnerability of the BNmodexp function crypto/bn/asm/x8664-mont5.pl in the OpenSSL library is related to the lack of protection for service data. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to confidential data...

Code execution vulnerability in KingView (CNVD-2020-45671)

KingView is an industrial automation configuration software produced by Beijing Asian Control Technology Development Co. A code execution vulnerability exists in KingView, which can be exploited by an attacker to gain control of a web server...

CVE-2020-9289

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key...

Code Execution Vulnerability in MetInfo of Changsha Mito Information Technology Co.

MetInfo is an open source free CMS building system suitable for enterprise building. Changsha Mito Information Technology Co., Ltd MetInfo has a code execution vulnerability that can be exploited by attackers to obtain server control privileges...

Any Indian DigiLocker Account Could've Been Accessed Without Password

The Indian Government said it has addressed a critical vulnerability in its secure document wallet service Digilocker that could have potentially let a remote attacker bypass mobile one-time passwords OTP and sign in as other users. Discovered separately by two independent bug bounty researchers,...