PT-2020-3328

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description The issue is related to insufficient access control in the DBI Setups component of Oracle E-Business Intelligence. It allows an unauthenticated attacker with network access via...

CVE-2020-2984: Undefined Security Weakness

Vulnerability in the Oracle Configuration Manager product of Oracle Enterprise Manager component: Discovery and collection script. The supported version that is affected is 12.1.2.0.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

Microsoft Office Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special...

CVE-2020-14577

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to...

PT-2020-5673

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 84.0.4147.89 Description The issue is related to a heap buffer overflow in the history component of Google Chrome, which can be exploited by a remote attacker using a crafted HTML page. This could potentially...

VirtualBox -- Multiple vulnerabilities

Oracle reports: Vulnerabilities in VirtualBox core can allow users with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of these vulnerabilities can result in unauthorized access to critical data, access to all Oracle V...

HPSBHF03674 rev. 1 - Synaptics® VFS75xx Fingerprint Sensors Equipped with External Flash

Potential Security Impact Information Disclosure Source: HP, HP Product Security Response Team PSRT Reported By: Synaptics® VULNERABILITY SUMMARY Synaptics has notified HP of a potential security vulnerability in certain versions of VFS75xx Fingerprint Sensors equipped with external flash, which...

PT-2020-5320

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 78 Description A use-after-free issue in the VideoStreamEncoder may occur due to a race condition with VideoBroadcaster::AddOrUpdateSink, potentially leading to memory corruption and a crash. This issue may allow a...

PT-2020-5628

Name of the Vulnerable Software and Affected Versions glib-networking versions 2.64.2 and earlier Balsa versions prior to 2.5.11 and 2.6.x prior to 2.6.1 Description The implementation of GTlsClientConnection in glib-networking skips hostname verification of the server's TLS certificate if the...

PT-2020-3428

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 83.0.4103.61 Description The issue is related to the use of memory after it has been freed in the WebRTC technology implementation in Google Chrome. This could allow a remote attacker to access confidential data...

Security Bulletin: Multiple vulnerabilities in IBM Java shipped with IBM Transformation Extender Advanced

Summary Multiple vulnerabilities with IBM Java version shipped with IBM Transformation Extender Advanced. These vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2018-2663 DESCRIPTION: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE...

Reddit: XSS in redditmedia.com can compromise data of reddit.com

Description Hi, i would like to report a XSS in redditmedia.com that can affect the reddit.com application. In redditmedia.com domain we are in the domain that reddit.com use to get all the thumbmails of any post. I found that redditmedia.com/gtm/jail uses the "id" parameter to get a valid GTM id...

Critical GitLab Flaw Earns Bounty Hunter $20K

A critical GitLab vulnerability, which could be leveraged by a remote attacker to execute code, recently netted a researcher a $20,000 bug-bounty award. The flaw was reported to GitLab by software developer William Bowling via the HackerOne bug bounty platform on March 23. It was then disclosed...

Man-in-the-Middle (MitM)

mysql-connector-python is vulnerable to man-in-the-middle attacks. Lack of server name verification allows an unauthenticated attacker with network access to compromise MySQL connectors in a man-in-the-middle attack to modify network traffic. This can result in unauthorized creation, deletion and...

Unspecified Vulnerability in Oracle Virtualization VM VirtualBox (CNVD-2020-51465 )

racle Virtualization is a set of virtualization solutions from Oracle Corporation. The product is used to unify the management of the entire hardware and software system from the application to the disk, can be virtualized from the desktop to the datacenter. vm VirtualBox is one of the virtual...

Oracle Virtualization VM VirtualBox has unspecified holes (CNVD-2020-24430)

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The product is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...

Unspecified Vulnerability in Oracle JD Edwards EnterpriseOne Tools (CNVD-2020-27996)

Oracle JD Edwards Products is a fully integrated suite of Enterprise Resource Planning ERP applications from Oracle Corporation. The products provide application modules for financial management, project management, and asset lifecycle management.JD Edwards EnterpriseOne Tools is one of the...

CVE-2020-2955

Vulnerability in the Oracle FLEXCUBE Core Banking product of Oracle Financial Services Applications component: Transaction Processing. The supported version that is affected is 4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2020-2952

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: Web Listener. The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful...

CVE-2020-2920

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Security. Supported versions that are affected are 9.3.3, 9.3.5 and 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attac...