jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the HikariDataSource gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

CVE-2020-13430

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource...

PT-2020-13536

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 7.0.0 Description The issue allows tag value XSS via the OpenTSDB datasource. This can be exploited in Grafana, potentially affecting devices that use the OpenTSDB datasource. No information is provided about the...

CVE-2020-13430: Improper Neutralization of Input During Web Page Generation

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource...

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the HikariDataSource gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

PT-2020-13123

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 7.2.1 Grafana versions through 6.7.3 Description An information-disclosure flaw was found in Grafana. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can...

CVE-2020-12458: Incorrect Permission Assignment for Critical Resource

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information e.g., cleartext or encrypted datasource passwords...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-18551)

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A cross-site scripting vulnerability exists in Ignite Realtime Openfire 4.4.1. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via the...

CVE-2019-20526

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...

CVE-2019-20525

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter...

Design/Logic Flaw

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...

CVE-2019-20526

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...

CVE-2019-20526

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...

CVE-2019-20525

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter...

CVE-2019-20525

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter...

Design/Logic Flaw

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter...

CVE-2019-20527

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter...

PT-2020-10501

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 4.4.1 Description The issue allows for XSS via the "driver" parameter in the setup/setup-datasource-standard.jsp endpoint. This endpoint is used for setting up a data source. The driver parameter is vulnerable,...

CVE-2019-20525: Improper Neutralization of Input During Web Page Generation

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter...

CVE-2019-20527: Improper Neutralization of Input During Web Page Generation

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter...