CVE-2021-41571 Pulsar Admin API allows access to data from other tenants using getMessageById API

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it f...

Mobility 只读API 安全漏洞

NetMotion Mobility is a mobile VPN software from NetMotion, Inc. It is used to securely extend enterprise networks to mobile environments. A security vulnerability exists in Mobility's read-only API, which stems from access control incorrectly validating user access rights. An attacker could...

IBM Security Guardium 信息泄露漏洞

IBM Security Guardium is a suite of platforms from IBM USA that provides data protection capabilities. The platform includes features such as customizable UI, report management and streamlined audit process building.IBM Security Guardium has a security vulnerability that could be exploited by a...

CVE-2021-20763

Operational restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal without the appropriate privilege...

CVE-2021-31160

CVE-2021-31160 affects Zoho ManageEngine ServiceDesk Plus MSP before version 10521. Connected sources consistently describe an improper access control vulnerability that allows an attacker to access internal data without authentication. The NVD entry lists CVSS v3.1 base score 7.5 (NETWORK, LOW a...

UBUNTU-CVE-2021-2291

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...

Oracle Hospitality Reporting and Analytics 输入验证错误漏洞

Oracle Hospitality Reporting and Analytics is a suite of platforms for hotels used by Oracle Corporation USA for generating reports for analyzing operational data. Oracle Hospitality Inventory Management Export to Reporting and Analytics 9.1.0 suffers from an input validation error vulnerability...

QEMU Access Control Error Vulnerability

QEMU Quick Emulator is a set of simulation processor software by Fabrice Bellard, a French individual developer. The software is fast and cross-platform. QEMU suffers from an Access Control Error vulnerability that can be exploited by an attacker to bypass access restrictions via virtiofsd in ord...

Unspecified Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (CNVD-2020-59225)

Oracle PeopleSoft Enterprise PeopleTools provides a comprehensive set of development tools that support the development and runtime of PeopleSoft applications. A security vulnerability exists in the PIA Core Technology component in Oracle PeopleSoft Enterprise PeopleTools 8.56, 8.57, and 8.58. An...

Unspecified Vulnerability in Oracle PeopleSoft Enterprise PeopleTools (CNVD-2020-59226)

Oracle PeopleSoft Enterprise PeopleTools provides a comprehensive set of development tools that support the development and runtime of PeopleSoft applications. A security vulnerability exists in the PIA Core Technology component in Oracle PeopleSoft Enterprise PeopleTools 8.56, 8.57, and 8.58. An...

Vulnerabilities fixed in Microsoft Dynamics

Microsoft fixes multiple vulnerabilities in Microsoft Dynamics products. The vulnerability in Microsoft Dynamics with the attribute CVE-2020-16943 allows a malicious person to access sensitive data. The vulnerabilities with the attributes CVE-2020-16956 and CVE-2020-16978 enable a remote maliciou...

Unspecified Vulnerability in Oracle Communications Applications Enterprise Communications

Oracle Enterprise Communications Broker is a core session manager designed to simplify complex multi-vendor VoIP and unified communications UC networks. A security vulnerability exists in Oracle Communications Applications Enterprise Communications. An attacker could exploit the vulnerability to...

Unspecified Vulnerability in Oracle Construction and Engineering Suite Primavera P6 Enterprise Project Portfolio Management

Oracle Construction and Engineering Suite is a suite of portfolio management solutions for construction projects from Oracle Corporation.Primavera P6 Enterprise Project Portfolio Management P6 is one of the components for planning, managing and executing projects. Primavera P6 Enterprise Project...

LDAP Injection

apache druid is vulnerable to LDAP injection. When LDAP authentication is enabled, the credentialsValidator.userSearch filter barrier can be bypassed and allows non-valid LDAP users to retrieve any LDAP attribute values of users that exist on the LDAP server...

Oracle PeopleSoft Enterprise PeopleTools Unauthorized Access Vulnerability (CNVD-2020-05101)

Oracle PeopleSoft Enterprise PeopleTools provides a comprehensive set of development tools that support the development and runtime of PeopleSoft applications. A security vulnerability exists in the PIA Core Technology component in Oracle PeopleSoft Enterprise PeopleTools 8.56, 8.57. An attacker...

Unspecified Vulnerability in Oracle Financial Services Applications Banking Corporate Lending

Oracle Financial Services Applications is a suite of financial services software from Oracle Corporation USA. The products include core banking, online banking, and property management.Oracle Banking Corporate Lending enables banks to adopt digital capabilities in credit management, origination,...

CVE-2019-17335

The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacke...

SQL Injection Vulnerability in Laike E-commerce System (CNVD-2020-00775)

Laike e-commerce with independent copyright system, is an integrated e-commerce system all the functions of the platform. A SQL injection vulnerability exists in Laike E-commerce system, which can be exploited by attackers to access sensitive database information...

Unspecified Vulnerability in Oracle Fusion Middleware Outside In Technology (CNVD-2019-37235)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle Corporation. The platform provides middleware, software collections, etc. Outside In Technology is one of the software development kit components. An...

Unspecified Vulnerability in Oracle Fusion Middleware Business Intelligence Enterprise Edition

Oracle Fusion Middleware Oracle Fusion Middleware is a suite of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collections and other features. business Intelligence Enterprise Edition is one of the components for the...