openSUSE Security Update : ldb / samba (openSUSE-2020-1023)

"This update for ldb, samba fixes the following issues : Changes in samba : - Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; bso14364 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2020-41455)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in MySQL Server 5.7.30 and earlier and Server 8.0.20 and earlier in Oracle MySQL: Pluggable Auth component. An attack...

CVE-2020-14553

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MyS...

CVE-2020-14553

CVE-2020-14553 affects Oracle MySQL Server (Server: Pluggable Auth) with versions 5.7.30 and prior and 8.0.20 and prior. The vulnerability allows a low-privilege, network-accessible attacker to perform unauthorized updates to MySQL data (I:LOW, A:N) via multiple protocols. Public sources confirm ...

CVE-2020-9496

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03...

Apache OFBiz XML-RPC Java Deserialization

This module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for versions prior to 17.12.01 using the ROME gadget chain. Versions up to 18.12.11 are exploitable utilizing an auth bypass CVE-2023-51467 and use the...

Exploit for Use of Hard-coded Credentials in Kiali

CVE-2020-1764 PoC Auth bypass PoC for Kiali 0.4.0 to 1.15.0 u...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

Cross site scripting

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2020-8176

CVE-2020-8176 affects koa-shopify-auth, versions 3.1.61–3.1.62. The vulnerability is an XSS via the shop parameter in /shopify/auth/enable_cookies. Root cause cited across sources is lack of sanitization of the shop value in multiple files (e.g., auth/client/request-storage-access.ts, auth/client...

EulerOS Virtualization 3.0.6.0 : openssh (EulerOS-SA-2020-1719)

According to the version of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users ...

MK-AUTH cross-site scripting vulnerability (CNVD-2021-17430)

MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. A cross-site scripting vulnerability exists in the admin and client scripts in MK-AUTH version 19.01, which can be exploited by an attacker to execute arbitrary JavaScript code...

MK-AUTH Trust Management Issue Vulnerability

MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. A trust management issue vulnerability exists in the Web login feature in MK-AUTH version 19.01, which can be exploited to bypass authentication and gain administrator access with the help of the...

Unspecified Vulnerability in MK-AUTH

MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. A security vulnerability exists in multiple endpoints of the /admin path in MK-AUTH version 19.01, which can be exploited to execute commands using shell metacharacters...

MK-AUTH Authorization Issues Vulnerability

MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. An authorization issue vulnerability exists in the Web login feature in MK-AUTH version 19.01, which can be exploited by an attacker to bypass authentication and gain client privileges...

MK-AUTH SQL Injection Vulnerability

MK-AUTH is an access control system from the Brazilian software developer Pedro Filho. A SQL injection vulnerability exists in the mkt/ PHP script in MK-AUTH version 19.01, which can be exploited by an attacker to execute illegal SQL commands...

CVE-2020-14071

An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...

CVE-2020-14070

An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executarlogin.php result in admin access...

CVE-2020-14069

An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...