CVE-2020-4470

CVE-2020-4470 affects IBM Spectrum Protect Plus Administrative Console (versions 10.1.0–10.1.5). The root cause is an incomplete fix that allowed an authenticated attacker to upload arbitrary files, which could be exploited to execute code on the vulnerable server. Public sources describe a follo...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is shipped with, or a required product for, IBM Tivoli Network Manager (CVE-2019-4670)

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Network Manager version 3.9 & 4.1.1; IBM WebSphere Application Server is a required product for IBM Tivoli Network Manager version 4.2. Information about a security vulnerability affecting IBM WebSphere Application Server has bee...

The vulnerability of the CLI command-line interface of Cisco IOS XE SD-WAN allows a attacker to execute arbitrary code with root privileges.

The vulnerability of the CLI command-line interface of Cisco IOS XE SD-WAN software is related to insufficient validation of entered data. Exploiting this vulnerability allows an attacker to execute arbitrary code with root privileges...

The vulnerability of VMware Fusion, Horizon Client for Mac, and VMware Remote Console for Mac lies in the insecure management of privileges, allowing an attacker to elevate their privileges to the root level.

The vulnerability of VMware Fusion, Horizon Client for Mac, and VMware Remote Console for Mac is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...

WSO2 API Manager and WSO2 API Microgateway, WSO2 IS as Key Manager Code Issue Vulnerabilities

WSO2 API Manager and so on are the products of WSO2 Corporation in the U.S.A. WSO2 API Manager is a set of API lifecycle management solutions.WSO2 API Microgateway is a cloud-native, scalable API gateway product.WSO2 IS as Key Manager is a key manager. A code issue vulnerability exists in...

CVE-2020-13883

In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle...

The vulnerability of the Information Manager Console component of the Oracle Knowledge business application allows a malicious individual to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Information Manager Console component in the Oracle Knowledge business application, where input data is not thoroughly verified. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data, or to unauthorizedly access protected...

The vulnerability of the Information Manager Console component of the Oracle Knowledge business application, which allows a perpetrator to compromise the integrity, confidentiality, and accessibility of protected information.

The vulnerability of the Information Manager Console component of the Oracle Knowledge business application relates to insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the integrity, confidentiality, and accessibility of protected information...

The vulnerability of the Information Manager Console component in the Oracle Knowledge business application, which allows a hacker to trigger a service failure.

The vulnerability of the Information Manager Console component in the Oracle Knowledge business application relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to trigger a service failure using the HTTP protocol...

The vulnerability of the Information Manager Console component of the Oracle Knowledge business application, which allows a perpetrator to compromise the integrity, confidentiality, and accessibility of protected information.

The vulnerability of the Information Manager Console component of the Oracle Knowledge business application relates to insufficient validation of input data. Exploiting this vulnerability allows an attacker to compromise the integrity, confidentiality, and accessibility of protected information...

The vulnerability of the Information Manager Console component of the Oracle Knowledge business application, which allows a malicious individual to gain access to modify, add, or delete data.

The vulnerability of the Information Manager Console component in the Oracle Knowledge business application relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain access to data modification, addition, or deletion through the HTTP protocol...

CVE-2020-12847

Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the application’s mailer configuration. It is...

Code injection

Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the application’s mailer configuration. It is...

CVE-2020-12847

CVE-2020-12847 affects Pydio Cells 2.0.4. An authenticated administrator can modify the mailer configuration (sendmail engine) and change the path to the sendmail binary without restriction, allowing execution of an arbitrary binary on the server. This is part of a set of vulnerabilities disclose...

CVE-2020-12847

Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the application’s mailer configuration. It is...

keycloak: CSRF check missing in My Resources functionality in the Account Console

It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

Secure Computing SnapGear Management Console SG560 v3.1.5 Arbitrary File Read/Write

Summary The SG gateway appliance range provides Internet security and privacy of communications for small and medium enterprises, and branch offices. It simply and securely connects your office to the Internet, and with its robust stateful firewall, shields your computers from external threats...

Secure Computing SnapGear Management Console SG560 v3.1.5 CSRF Add Super User

Summary The SG gateway appliance range provides Internet security and privacy of communications for small and medium enterprises, and branch offices. It simply and securely connects your office to the Internet, and with its robust stateful firewall, shields your computers from external threats...

Cisco 809 Industrial ISRs, 829 Industrial ISRs, and Cisco CGR1000 IOS Software Trust Management Issue Vulnerabilities

Cisco 1000 Series Connected Grid Routers CGR1000 is a 1000 Series Internet Grid Router from Cisco. A trust management issue exists in the virtual console authentication of the IOS Software in Cisco 809 Industrial ISRs, 829 Industrial ISRs, and Cisco CGR1000. The vulnerability stems from the...

Secure Computing SnapGear Management Console SG560 3.1.5 Arbitrary File Read / Write

Secure Computing SnapGear Management Console SG560 v3.1.5 Arbitrary File Read/Write Vendor: Secure Computing Corp. Product web page: http://www.securecomputing.com Affected version: 3.1.5u1 Summary: The SG gateway appliance range provides Internet security and privacy of communications for small...