Session fixation

A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue...

CVE-2019-3867

A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue...

Cybozu Office 授权问题漏洞

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. A view restriction bypass vulnerability exists in the phone messages in Cybozu Office. An attacker can exploit this vulnerability to obtain phone message data without viewing privileges...

The vulnerability of the Samba networking communication package is related to deficiencies in the cryptographic security mechanism, allowing attackers to gain access to confidential data.

The vulnerability of the Samba networking communication package is related to deficiencies in the cryptographic security mechanism. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

CVE-2021-23827

Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive media such as private pictures in the Cache and uploadtemps directories. It fails to effectively clear cached pictures, even after deletion via normal methodolog...

CVE-2020-8587

OnCommand System Manager 9.x versions prior to 9.3P20 and 9.4 prior to 9.4P3 are susceptible to a vulnerability that could allow HTTP clients to cache sensitive responses making them accessible to an attacker who has access to the system where the client runs...

CVE-2021-25227

Trend Micro Antivirus for Mac 2021 Consumer is vulnerable to a memory exhaustion vulnerability that could lead to disabling all the scanning functionality within the application. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2021-25755

In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic...

Red Hat openshift4/ose-docker-builder security vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that supports building, testing, deploying, and running applications. A security vulnerability in Red Hat openshift4/ose-docker-builder can be exploited by an attacker to gain access to this build...

The vulnerability of the app.support.baseURL configuration in the Mozilla Firefox browser allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the app.support.baseURL configuration in Mozilla Firefox browser lies in the lack of content sanitization in the URL string. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

USN-4705-2 sudo vulnerability

USN-4705-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue to obtain...

CVE-2020-25173

An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local network access...

Weak Password Vulnerability in Ruijie Unified Internet Behavior Management and Auditing System

Ltd. is a company that utilizes new technologies such as cloud computing, SDN, mobile Internet, big data, and Internet of Things to provide end-to-end solutions for users in various industries. A weak password vulnerability exists in the Ruijie Unified Internet Behavior Management and Audit Syste...

Logic flaw vulnerability in Waychar enrollment system backend

Waychar Registration System is a free race registration system. A logic flaw vulnerability exists in the backend of the Waychar registration system. An attacker can exploit this vulnerability to log directly into the backend...

Veritas Resiliency Platform Code Execution Vulnerability

Veritas Technologies Resiliency Platform VRP is a suite of data protection solutions from Veritas Technologies, USA. A security vulnerability exists in Veritas Resiliency Platform versions 3.4 and 3.5, which can be exploited by an attacker to gain administrator access to the system, resulting in...

CVE-2020-26199

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials including the Unisphere admin privilege user password is stored in a plain text in multiple log files. A local authenticated attacker with access to the l...

多款Amino产品信任管理问题漏洞

The Amino Communications AK45x series, among others, is a family of television set-top box devices from Amino UK. Amino Communications has a trust management issue vulnerability that stems from the use of hard-coded passwords, which can be exploited by a local attacker to view and interact with t...

CVE-2020-35187

The official telegraf docker images before 1.9.4-alpine Alpine specific contain a blank password for a root user. System using the telegraf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password...

SQL Injection Vulnerability in Environmental Automatic Monitoring System of Jiangsu Sanxi Technology Co.

The business scope of Jiangsu Sanxi Technology Co., Ltd. includes: environmental monitoring and control systems, automation systems, information management systems, computers, communications, control systems, and other types of systems such as software and hardware development. Jiangsu Sanxi...

IBM Planning Analytics 跨站请求伪造漏洞

IBM Planning Analytics is a planning, budgeting, forecasting and analytics solution. A cross-site request forgery vulnerability exists in IBM Planning Analytics 2.0. An attacker could exploit this vulnerability to perform malicious and unauthorized actions transmitted from a user trusted by the...