CVE-2020-2186: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances...

PT-2020-15400 · Jenkins · Jenkins Amazon Ec2 Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier Description: A cross-site request forgery issue allows attackers to provision instances. The vulnerability is due to the plugin not requiring POST requests in several HTTP endpoints,...

UBUNTU-CVE-2020-11032

In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6...

CVE-2020-11032

In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6...

CVE-2020-5864

In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default...

CVE-2020-3952

creationtimestamp| type| source ---|---|--- 2020-04-12 06:01:42+00:00| seen| https://t.me/informationsecuritychannel/36785 2020-04-13 15:30:02+00:00| seen| https://t.me/SecLabNews/7342 2020-04-16 09:08:53+00:00| published-proof-of-concept| https://t.me/techpwnews/434 2020-04-16 12:54:03+00:00|...

Improper access control

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates ar...

CVE-2019-4716

creationtimestamp| type| source ---|---|--- 2020-03-30 15:59:19+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/ibmtm1unauthrce.rb 2020-03-31 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48273 2021-11-08 08:58:18+00:00| seen|...

Fedora: Security Advisory for mediawiki (FEDORA-2020-a8ac31fed0)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-8655

creationtimestamp| type| source ---|---|--- 2020-03-02 21:31:51+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/eyesofnetworkautodiscoveryrce.rb 2020-03-05 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48169 2021-11-08...

Institute of International Education leaks data of thousands of students

By Waqas Another day, another data breach - This time, MongoDB instances at it again owned by the Institute of International Education IIE. This is a post from HackRead.com Read the original post: Institute of International Education leaks data of thousands of students...

Unspecified vulnerability in ezmaster

ezmaster is a tool for managing Docker applications and instances. A security vulnerability exists in ezmaster that can be exploited by an attacker to execute commands as the root user...

Qualys Cloud Platform 8.22 New Features (VM, PC)

Update December 11, 2019: See additional details about this release. The 8.22.0 release adds several new features in Qualys Cloud Platform, adds a new API in Policy Compliance and support for 2 new technologies for OCA. Feature Highlights Qualys Cloud Platform Support for DNS tracking – You can n...

Adobe Acrobat Reader DC XFA Form Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Pro DC XFA Form Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processin...

CVE-2017-12629

It was found that Apache Lucene would accept an object from an unauthenticated user that could be manipulated through subsequent post requests. An attacker could use this flaw to assemble an object that could permit execution of arbitrary code if the server enabled Apache Solr's Config API...

CVE-2019-12674 Cisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities

Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. These vulnerabilities are due to...

Moderate: Red Hat Security Advisory: openstack-nova security and bug fix update

An update for openstack-nova is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2019-15753

In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instance...

Security update for mariadb, mariadb-connector-c (important)

openSUSE Security Update: Security update for mariadb, mariadb-connector-c Announcement ID: openSUSE-SU-2019:1915-1 Rating: important References: 1126088 1132666 1136035 Cross-References: CVE-2019-2614 CVE-2019-2627 CVE-2019-2628 Affected Products: openSUSE Leap 15.0 An update that fixes three...