9969 matches found
PT-2020-14191
Name of the Vulnerable Software and Affected Versions Solidus versions prior to 2.8.6 Solidus versions prior to 2.9.6 Solidus versions prior to 2.10.2 Description This issue allows a malicious customer to change the order address without triggering address validations, potentially altering shipme...
CVE-2020-15109: Improper Input Validation
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the...
Extract and Use Custom Attributes from Active Directory for NetScaler Appliance
Although Active Directory AD username and realm/domain attributes are often sufficient for identifying a user, at times you need even more details of the user. For example, "UserPrincipalName" that contains the user’s domain might represent a forest level realm and not the organization to which t...
IBM Publishing Engine Information Disclosure Vulnerability
IBM Publishing Engine is a tool for generating documents from data stored in other software tools. An information disclosure vulnerability exists in IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0, which stems from the product not setting security attributes on authorization tokens or session...
CVE-2020-15721
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
Servicing stack update for Windows 10: July 14, 2020
None None...
Servicing stack update for Windows 10, version 1607: July 14, 2020
None None...
Servicing stack update for Windows 10, version 1809: July 14, 2020
None None...
Servicing stack update for Windows 10, version 2004: July 14, 2004
None None...
Servicing stack update for Windows Server 2008 SP2: July 14, 2020
Servicing stack update for Windows Server 2008 SP2: July 14, 2020 Applies to Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Server Core installation Windows Server 2008 for Itanium-Based Systems Service Pack 2 Windows Server 2008 for...
PT-2020-14608
Name of the Vulnerable Software and Affected Versions RosarioSIS versions prior to 6.8-beta Description The issue is related to a problem with the href attributes for "AddStudents.php" and "User.php" in the NotifyParents.php file within the Custom module, allowing for XSS attacks. Recommendations...
CVE-2020-15721: Improper Neutralization of Input During Web Page Generation
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
Unspecified vulnerability in MISP (CNVD-2020-51414)
MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP version 2.4.128, which stems from insufficient ACL...
CVE-2020-15306
An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize in IlmImf/ImfMisc.cpp...
CVE-2020-15306
An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize in IlmImf/ImfMisc.cpp...
CVE-2020-15306
An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize in IlmImf/ImfMisc.cpp...
Apache Archiva Injection Vulnerability (CNVD-2020-44097)
Apache Archiva is a suite of software from the Apache USA Software Foundation for managing one or more remote repositories. The software provides features such as remote Repository agents, role-based secure access management, and usage reporting. A security vulnerability exists in Apache Archiva...
Important: kernel-livepatch-4.14.173-137.229
Issue Overview: In the Linux kernel 5.0.21, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4xattrsetentry use-after-free in fs/ext4/xattr.c when a large oldsize value is used in a memset call. CVE-2019-19319 Affected...
Server-side Request Forgery (SSRF)
batik-svgrasterizer is vulnerable to server side request forgery SSRF. It is possible as it does not prevent an attacker to make malicious GET requests on behalf of the server through the use of xlink:hrefattributes which allows access to internal resources...