CVE-2019-4326

The CVE-2019-4326 entry concerns HCL AppScan Enterprise: the security rules update administration section of the web application console lacks the HTTP Strict-Transport-Security (HSTS) header. Affected component is the admin/service console for AppScan Enterprise; underlying issue is missing HSTS...

CVE-2020-24627

A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches versions: G2 4x1Ex32 Prior to 2.8.3...

CVE-2020-24628

A remote code injection vulnerability was discovered in HPE KVM IP Console Switches versions: G2 4x1Ex32 Prior to 2.8.3...

CVE-2020-24627

A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches versions: G2 4x1Ex32 Prior to 2.8.3...

CVE-2020-24628

A remote code injection vulnerability was discovered in HPE KVM IP Console Switches versions: G2 4x1Ex32 Prior to 2.8.3...

Cross site scripting

A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches versions: G2 4x1Ex32 Prior to 2.8.3...

CVE-2020-24628

CVE-2020-24628 affects HPE KVM IP Console Switches (G2 4x1Ex32) prior to version 2.8.3. The issue is described as a remote code injection vulnerability. Supported documents confirm the affected product family and version range; no root-cause technical details or patch/mitigation are provided in t...

CVE-2020-24628

A remote code injection vulnerability was discovered in HPE KVM IP Console Switches versions: G2 4x1Ex32 Prior to 2.8.3...

CVE-2020-24627

CVE-2020-24627: A remote stored cross‑site scripting vulnerability affecting HPE KVM IP Console Switches (G2 4x1Ex32) prior to 2.8.3. Documents confirm the vulnerability type (XSS) and affected product/versions, but do not provide concrete root-cause details or explicit exploitation steps. No rem...

CVE-2020-24627

A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches versions: G2 4x1Ex32 Prior to 2.8.3...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2020-8164).

Summary There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2020-8164 DESCRIPTION: Ruby on Rails could allow a remote attacker to obtain sensitive information, caused by the deserialization of untrusted data. By sending a specially...

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ

It was found that Hawtio console does not set HTTPOnly or Secure attributes on cookies. An attacker could use this flaw to rerieve an authenticated user's SessionID, and possibly conduct further attacks with the permissions of the authenticated user...

VulnCheck KEV: CVE-2018-14665

A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root...

The vulnerability of VMware Fusion, Horizon Client for Mac, and VMware Remote Console for Mac lies in the insecure management of privileges, allowing an attacker to elevate their privileges to the root level.

The vulnerability of VMware Fusion, Horizon Client for Mac, and VMware Remote Console for Mac is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...

Amazon Linux 2 : kernel (ALAS-2020-1495)

The version of kernel installed on the remote host is prior to 4.14.198-152.320. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1495 advisory. In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and...

CVE-2020-13658

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

CVE-2020-13658

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

Cross site request forgery (csrf)

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privileges within the application...

Lansweeper Cross-Site Request Forgery Vulnerability

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A cross-site request forgery vulnerability exists in Lansweeper version 8.0.130.17. The vulnerability stems from the vulnerability of the web...

HPESBHF04044 rev.2 - HPE IP Console Switch G2 4x1Ex32, Remote Stored XSS and Code Injection.

Potential Security Impact: Remote: script injection, persistent cross site scripting SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE KVM IP Console Switches G2 4x1Ex32 Prior to 2.8.3 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2020-24627 |...