CVE-2020-14564

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Environment Mgmt Console. Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...

Cross site scripting

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability...

CVE-2020-14572

CVE-2020-14572 affects Oracle WebLogic Server (Fusion Middleware) Console. Affects supported versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise WebLogic Server; exploitation requires user inte...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory: Description High SECURITY-1868 / CVE-2020-2220 Stored XSS vulnerability in job build time trend High SECURITY-1901 / CVE-2020-2221 Stored XSS vulnerability in upstream cause High SECURITY-1902 / CVE-2020-2222 Stored XSS vulnerability in 'keep forever' badge icons High...

PT-2020-15439 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.244 and earlier Jenkins LTS versions 2.235.1 and earlier Description: The issue results from incorrect escaping of the href attribute of links to downstream jobs displayed in the build console page, leading to a stored...

CVE-2020-6278

SAP Business Objects Business Intelligence Platform BI Launchpad and CMC, versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting...

Advantech WebAccess/SCADA suffers from a command execution vulnerability (CNVD-2020-48621)

Advantech WebAccess/SCADA is a suite of SCADA software based on a browser architecture. A command execution vulnerability exists in Advantech WebAccess/SCADA. An attacker could exploit the vulnerability to execute console commands...

Advantech WebAccess/SCADA suffers from a command execution vulnerability (CNVD-2020-48618)

Advantech WebAccess/SCADA is a suite of SCADA software based on a browser architecture. A command execution vulnerability exists in Advantech WebAccess/SCADA. An attacker could exploit the vulnerability to execute console commands...

CVE-2020-3974

VMware Fusion 11.x before 11.5.5, VMware Remote Console for Mac 11.x and prior before 11.2.0 and Horizon Client for Mac 5.x and prior before 5.4.3 contain a privilege escalation vulnerability due to improper XPC Client validation. Successful exploitation of this issue may allow attackers with...

CVE-2020-3974

VMware Fusion 11.x before 11.5.5, VMware Remote Console for Mac 11.x and prior before 11.2.0 and Horizon Client for Mac 5.x and prior before 5.4.3 contain a privilege escalation vulnerability due to improper XPC Client validation. Successful exploitation of this issue may allow attackers with...

CVE-2020-3974

CVE-2020-3974 affects VMware Fusion 11.x (pre-11.5.5), VMware Remote Console for Mac 11.x (pre-11.2.0), and Horizon Client for Mac 5.x (pre-5.4.3). It is a local privilege-escalation due to improper XPC Client validation, allowing a normal-privilege user to gain root access. Exploitation requires...

VMware Releases Security Updates for Multiple Products

VMware has released security updates to address a vulnerability in VMware Fusion, Remote Console, and Horizon Client. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators t...

VMSA-2020-0017:VMware Fusion, VMware Remote Console and Horizon Client updates address a privilege escalation vulnerability

Advisory ID: VMSA-2020-0017 CVSSv3 Range: 7.8 Issue Date:2020-07-09 Updated On: 2020-07-09 Initial Advisory CVEs: CVE-2020-3974 Synopsis: VMware Fusion, VMware Remote Console and Horizon Client updates address a privilege escalation vulnerability CVE-2020-3974 RSS Feed Download PDF Download Text...

pocsuite

This is a Python-based framework for remote vulnerability testing and proof-of-concept development, known as Pocsuite. It is developed by the Knownsec Security Team and comes with a powerful proof-of-concept engine, many niche features for penetration testers and security researchers. The framewo...

CVE-2004-1653 SSH port forwarding exposes unprotected internal services

An improper access control vulnerability in the admin SSH console of multiple products may allow an authenticated user to access internal only system services via using SSH local port forwarding. A successful attack needs an authenticated admin SSH user to set up a port bounce to product internal...

Cross site scripting

Cross-site Scripting XSS vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record o...

CVE-2020-14005

Solarwinds Orion with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4 allows remote attackers to execute arbitrary code via a defined event...

CVE-2020-14006

Solarwinds Orion with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4 allows XSS via a Responsible Team...

CVE-2020-14005

SolarWinds Orion Platform (Web Console WPM 2019.4.1, Orion Platform HF4 or NPM HF2 2019.4) is affected by CVE-2020-14005, a remote code execution vulnerability. The issue allows an attacker to execute arbitrary code via a defined event, with exploitation details tied to command-injection-like pat...

CVE-2020-14006

SolarWinds Orion is affected by CVE-2020-14006 due to a cross-site scripting flaw in the Web Console (WPM 2019.4.1, Orion Platform HF4 or NPM HF2 2019.4). The issue stems from inadequate validation of client-supplied data by the WEB application, enabling an attacker to run client‑side code. Docum...