PT-2020-4568 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition versions 5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Installation component of Oracle Business Intelligence Enterprise Edition,...

Command Execution Vulnerability in Qiji Fortress v5.0 at Zhejiang Qiji Technology Co. Ltd (CNVD-2020-59414)

Qiji Technology is a product-based company founded by O&M management experts and focused on O&M operations. A command execution vulnerability exists in Zhejiang Qiji Technology Co. Qiji Fortress v5.0, which can be exploited by an attacker to gain server control privileges...

Vulnerabilities fixed in phpMyAdmin

Two vulnerabilities have been fixed in phpMyAdmin. A remote malicious party could exploit the vulnerabilities to execute an SQL injection or Cross-Site Scripting XSS attack. To exploit the XSS vulnerability, the malicious party must create a persuade phpMyAdmin user to open a rogue URL. XSS can...

DEBIAN-CVE-2020-26934

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link...

DEBIAN-CVE-2020-26935

An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query...

File Containment Vulnerability in MetInfo Enterprise Website Builder (CNVD-2020-58429)

MetInfo Enterprise Building System is a free and open source enterprise CMS. A file inclusion vulnerability exists in MetInfo version v5.0.4, which can be exploited by attackers to gain control of the server...

GHSA-X56P-C8CG-Q435 Open Redirect in Next.js versions

Impact - Affected: Users of Next.js between 9.5.0 and 9.5.3 - Not affected: Deployments on Vercel https://vercel.com are not affected - Not affected: Deployments using next export We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. Patches...

UBUNTU-CVE-2020-11031

In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The librar...

CVE-2020-17465

Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4, 6.0.0.6...

Squid Denial of Service Vulnerability (CNVD-2020-48582)

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in Squid versions prior to 4.13 and 5.0.4 in the 5.x series, which can be exploited by...

Vulnerabilities fixed in Squid

Squid's developers have fixed three vulnerabilities. Of one vulnerability no CVE-id is known. The vulnerabilities allow a remote malicious party the ability to use cache poisoning to potentially gain access to sensitive data, or to cause a Denial-of-Service. The developers have released updates t...

Atlassian Confluence Server and Data Center Cross-Site Scripting Vulnerability

Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi.Atlassian Confluence Data Center is the data center version of Atlassian Confluence. Atlassian...

CVE-2020-14175

Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in user macro parameters. The affected versions are before version 7.4.2, and from version 7.5.0 before 7.5.2...

Squid Code Problem Vulnerability

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in Squid versions prior to 4.12 and 5.x versions prior to 5.0.3. An attacker could...

CVE-2020-5588

Path traversal vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to obtain unintended information via unspecified vectors...

Cybozu Garoon path traversal vulnerability (CNVD-2020-36769)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A path traversal vulnerability exists in Cybozu Garoon versions 5.0.0 through 5.0.1. An attacker can exploit this...

Cybozu Garoon Bypass View Privilege Vulnerability

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A security vulnerability exists in Cybozu Garoon versions 4.0.0 to 5.0.1. A remote attacker can exploit the...

Phpyun Talent Management System v5.0 has an arbitrary file read vulnerability

phpyun is a talent management system. Phpyun Talent Management System v5.0 has an arbitrary file reading vulnerability that can be exploited by attackers to read arbitrary files...

Insecure Encryption

Overview bcrypt is an A library to help you hash passwords. Affected versions of this package are vulnerable to Insecure Encryption. Data is truncated wrong when its length is greater than 255 bytes. Remediation Upgrade bcrypt to version 5.0.0 or higher. References - GitHub Issue - GitHub PR 1 -...

Huawei NIP6800, Secospace USG6600 and USG9500 Memory Leak Vulnerabilities (CNVD-2020-36723)

Huawei USG9500 and others are products of Huawei, China.USG9500 is a data center firewall product.NIP6800 is an intrusion prevention system.Secospace USG6600 is a next-generation firewall product. A security vulnerability exists in the Huawei NIP6800, Secospace USG6600, and USG9500. An attacker...