Input validation

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

UBUNTU-CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

CVE-2020-10693

CVE-2020-10693 affects Hibernate Validator 6.1.2.Final, where a bug in the message interpolation processor allows invalid EL expressions to be evaluated and bypass input sanitation in error messages. IBM advisories confirm the vulnerability in Hibernate Validator and reference vendor fixes. Remed...

CVE-2020-5880

Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server...

IBM Cognos Analytics Information Disclosure Vulnerability (CNVD-2020-26252)

IBM Cognos Analytics is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. An information disclosure...

[SECURITY] Fedora 32 Update: snakeyaml-1.26-1.fc32

SnakeYAML features: a complete YAML 1.1 parser. In particular, SnakeYAML can parse all examples from the specification. Unicode support including UTF-8/UTF-16 input/output. high-level API for serializing and deserializing native Java objects. support for all types from the YAML types repository...

CVE-2020-11691

In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible...

CVE-2020-4277

IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-Force ID: 175993...

CVE-2020-4277

IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-Force ID: 175993...

Information disclosure

IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-Force ID: 175993...

CVE-2020-4277

IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-Force ID: 175993...

CVE-2020-4277

IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 expose sensitive information in error messages, enabling information disclosure as described in CVE-2020-4277. Affected products: IBM TRIRIGA Application Platform (versions 3.5.3, 3.6.1). Root cause: error messages reveal details that could aid att...

Security Bulletin: IBM TRIRIGA Application Platform discloses error messages that could aid an attacker formulate future attacks (CVE-2020-4277)

Summary IBM TRIRIGA Application Platform discloses error messages that could aid an attacker formulate future attacks CVE-2020-4277. Vulnerability Details CVEID: CVE-2020-4277 DESCRIPTION: IBM TRIRIGA Application Platform discloses error messages that could aid an attacker formulate future attack...

Veeam ONE Remote Code Execution Vulnerabilities

Challenge Vulnerabilities in Veeam ONE Agent components residing on Veeam ONE and Veeam Backup & Replication servers allow executing malicious code remotely without authentication. This may lead to gaining control over the target system. Severity : critical CVSS v3 score : 9.8 Cause Veeam ONE Age...

Service Update 0.14 for Microsoft Dynamics 365 9.0

None None...

Information Disclosure

spacewalk-backend is vulnerable to information disclosure. The vulnerability exists when a user submitted a system registration XML-RPC call to an RHN Satellite server for example, by running "rhnregks" and that call failed, their RHN user password was included in plain text in the error messages...

CVE-2020-4239

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 175412...

[SECURITY] Fedora 32 Update: PyYAML-5.3.1-1.fc32

YAML is a data serialization format designed for human readability and interaction with scripting languages. PyYAML is a YAML parser and emitter for Python. PyYAML features a complete YAML 1.1 parser, Unicode support, pickle support, capable extension API, and sensible error messages. PyYAML...

[SECURITY] Fedora 30 Update: PyYAML-5.3.1-1.fc30

YAML is a data serialization format designed for human readability and interaction with scripting languages. PyYAML is a YAML parser and emitter for Python. PyYAML features a complete YAML 1.1 parser, Unicode support, pickle support, capable extension API, and sensible error messages. PyYAML...