Ruby on Rails Remote Code Execution Vulnerability (CNVD-2020-34451)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A security vulnerability exists in Ruby on Rails versions prior to 5.0.1. A remote attacker can exploit the vulnerability to execute code...

Tenable Network Security Tenable.Sc Cross-Site Scripting Vulnerability

Tenable Network Security Tenable.Sc is a vulnerability analysis solution from Tenable Network Security, USA. The product supports real-time vulnerability assessment and management, among other things. A cross-site scripting vulnerability exists in Tenable Network Security Tenable.Sc versions prio...

McAfee Agent Access Control Error Vulnerability

McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator antivirus management platform and managed products. An access control error vulnerability exists in the masvc.exe file in McAfee Agent versions prior to 5.6.4. A local...

CVE-2020-7579

A vulnerability has been identified in Spectrum Power™ 5 All versions v5.50 HF02. The web server could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. If deployed according to...

pacman command injection vulnerability

pacman is a package manager used in Linux. A command injection vulnerability exists in the 'applydeltas' function in the lib/libalpm/sync.c file in pacman versions prior to 5.2. The vulnerability stems from a network system or product not properly filtering special elements of external input data...

UBUNTU-CVE-2020-2701

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracl...

UBUNTU-CVE-2020-2689

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle V...

Zabbix SIA Zabbix Encryption Issues Vulnerabilities

Zabbix SIA Zabbix is an open source monitoring system from the Latvian company Zabbix SIA. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. Zabbix SIA An encryption issue vulnerability exists in versions of Zabbix prior to 5.0, which stems fr...

XScreenSaver Access Control Error Vulnerability

XScreenSaver is an open source screen saver program written in C language. An Access Control Error vulnerability exists in versions of XScreenSaver prior to 5.14, which can be exploited by an attacker to cause the program to crash, prevent the screen from locking, and then access resources...

DEBIAN-CVE-2019-19534

In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peakusb/pcanusbcore.c driver, aka CID-f7a1337f0d29...

Cloudera CDH Information Disclosure Vulnerability

Cloudera CDH is an open source Hadoop platform from Cloudera. The platform provides scalable storage and distributed computing, as well as a Web-based user interface and other enterprise features. An information disclosure vulnerability exists in the Diagnostic Support Bundles in Cloudera CDH...

CVE-2019-19021

An issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account with a hard-coded password in the web administration interface, with administrator privileges. Anybody can log in with this account...

Linux kernel memory leak vulnerability (CNVD-2019-41265)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A memory leak vulnerability exists in the acphwinit function in drivers/gpu/drm/amd/amdgpu/amdgpuacp.c in versions of...

SECUDOS DOMOS Log Module Cross-Site Scripting Vulnerability

SECUDOS DOMOS is an operating system for IoT devices from SECUDOS Germany. log is one of the logging modules. A cross-site scripting vulnerability exists in the Log module in SECUDOS DOMOS versions prior to 5.6. The vulnerability stems from the lack of proper validation of client-side data in the...

NetApp OnCommand Workflow Automation Information Disclosure Vulnerability

NetApp OnCommand Workflow Automation is a suite of storage process management software from American NetApp. The software provides storage configuration, storage cloning and other functions for the database or file system. An information disclosure vulnerability exists in NetApp OnCommand Workflo...

avada theme for WordPress cross-site scripting vulnerability

avada theme for WordPress is a responsive multipurpose theme plugin for use in WordPress. A cross-site scripting vulnerability exists in avada theme for WordPress versions prior to 5.1.5. The vulnerability stems from a lack of proper validation of client-side data by the web application. An...

Linux kernel denial of service vulnerability (CNVD-2019-32353)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in Linux kernel versions prior to 5.0.4, which stems from the failure of the 9p file system to properly protect isizewrite. An attacker...

Telegram Information Disclosure Vulnerability (CNVD-2019-32023)

Telegram is an instant messaging mobile application. An information disclosure vulnerability exists in versions of Telegram prior to 5.11 based on the Android platform. The vulnerability stems from an error in configuration or other errors in the operation of a networked system or product. An...

PT-2019-3108 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.2.3 Description: The issue is related to a NULL pointer dereference in the drivers/media/usb/zr364xx/zr364xx.c driver, caused by a malicious USB device. This can lead to a denial of service. Recommendations: F...

PT-2019-12950 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.7 Description: A PHP object instantiation issue in Shopware allows a crafted web request to trigger an arbitrary deserialization, potentially leading to remote code execution if the right class is instantiated. Th...