CVE-2020-14007

Solarwinds Orion with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4 allows XSS via a name of an alert definition...

HD intelligent recording system has logic flaw vulnerability

Guangzhou YingKeVision Electronic Technology Co., Ltd. is a high-tech enterprise focusing on big education, integrating R&D, design, production and sales. There is a logic flaw vulnerability in the HD Intelligent Recording and Broadcasting System, which can be exploited by an attacker to...

The vulnerability of the program for installing SSL certificates in the standardized Linux Sblim-sfcb toolset is related to an incorrect definition of the link before accessing the file. This allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability in the program for installing SSL certificates in the standardized Linux Sblim-sfcb tool relates to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow a perpetrator to gain access to confidential data, compromise its integrity,...

PYSEC-2020-240

A Denial of Service DoS condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service...

Design/Logic Flaw

A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, 4.3.11SP, 4.4.9SP, 4.5.5SP, 4.6.4 and 4.7.2 enable unauthenticated users to perform MITM attacks via the B&R upgrade server...

GaussDB: Enable DDL Audit

If AUDITLEVEL is set to 1, only Data Definition Language DDL operations such as CREATE, DROP, and ALTER are audited. DDL is used to define or modify database objects, such as tables, indexes, views, synonyms, databases, sequences, users, roles, tablespaces, profiles, and sessions. In addition,...

EulerOS Virtualization 3.0.2.2 : ruby (EulerOS-SA-2020-1443)

According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteractionverbose calls say without escaping, esca...

CIPPlanner CIPAce Code Issue Vulnerability

CIPPlanner CIPAce is a suite of business process automation and application development platforms from the US-based CIPPlanner. A code issue vulnerability exists in CIPPlanner CIPAce version 9.1 Build 2019092801. The vulnerability stems from an improperly designed or implemented code development...

When You Should Blog and When You Should Tweet

I saw my like-minded, friend-that-I've-never-met Andrew Thompson Tweet a poll, posted above. I was about to reply with the following Tweet: "If I'm struggling to figure out how to capture a thought in just 1 Tweet, that's a sign that a blog post might be appropriate. I only use a thread, and no...

The vulnerability of the Windows Installer component on Windows operating systems, which allows a hacker to increase their privileges

The vulnerability of the Windows Installer component in Windows operating systems is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to enhance their privileges through a specially created application...

ZOHO ManageEngine Desktop Central XML External Entity Injection Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. An XML external entit...

The vulnerability of the XMLBlueprint XML file editor, related to errors in processing .dtd files, allows a perpetrator to cause service failures or enable reading of arbitrary files.

The vulnerability of the XMLBlueprint XML editor is related to errors in processing .dtd files. Exploiting this vulnerability can allow a malicious actor to cause service failures or enable the reading of arbitrary files by running a specially crafted XML file...

The vulnerability of the Server:DDL component of the Oracle MySQL database management system allows a hacker to cause a service failure.

The vulnerability of the Server:DDL component of the Oracle MySQL database management system is related to an uncontrolled consumption of system resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

Vulnerability of the Server component: The MySQL Server database management system component, which allows a hacker to cause a service failure.

Vulnerability of the MySQL Server component: The DDL system for database management of MySQL Server is vulnerable to resource release errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

PT-2020-10450 · Wso2 · Wso2 Api Manager

Name of the Vulnerable Software and Affected Versions: WSO2 API Manager version 2.6.0 Description: A potential Reflected Cross-Site Scripting XSS issue has been identified in defining a scope in the "manage the API" page of the API Publisher. Recommendations: For WSO2 API Manager version 2.6.0,...

CVE-2019-20153

An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM in v5.4. An XML external entity XXE vulnerability in the upload definition feature in definitionuploadattach.jsp allows authenticated remote attackers to read arbitrary files including configuration files...

Xxe

An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM in v5.4. An XML external entity XXE vulnerability in the upload definition feature in definitionuploadattach.jsp allows authenticated remote attackers to read arbitrary files including configuration files...

CVE-2019-20153

CVE-2019-20153 concerns Determine Contract Lifecycle Management (CLM) v5.4, where an XML External Entity (XXE) flaw in the upload definition feature (definition_upload_attach.jsp) allows authenticated remote attackers to read arbitrary files, including configuration files with administrative cred...

The vulnerability of the Server:DDL component of the Oracle MySQL database management system allows a hacker to cause a service failure.

The vulnerability of the Server:DDL component of the Oracle MySQL database management system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause service interruptions using the MySQL network protocol...

5 Reasons Why Programmers Should Think like Hackers

Programming has five main steps: the identification and definition of the problem, the planning of the solution for the problem, coding of the program, testing, and documentation. It's a meticulous process that cannot be completed without going through all the essential points. In all of these,...