CVE-2020-14565

CVE-2020-14565 affects Oracle Unified Directory within Oracle Fusion Middleware Security component. Exploitation requires network access via HTTP with user interaction; vulnerable versions include 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0. Impact per sources: potential unauthorized data access/modif...

CVE-2020-14548

CVE-2020-14548 affects Oracle Fusion Middleware’s Oracle Business Intelligence Enterprise Edition (Analytics Web General). Affected versions are 12.2.1.3.0 and 12.2.1.4.0. The vulnerability allows an unauthenticated, network-accessible attacker (HTTP) to read a subset of data, with exploitation r...

CVE-2020-14552

CVE-2020-14552 affects Oracle WebCenter Portal (Oracle Fusion Middleware) - Security Framework, with affected versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise WebCenter Portal and potentially access all p...

CVE-2020-14552

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Security Framework. Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromis...

CVE-2020-14552

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Security Framework. Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromis...

CVE-2020-14548

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: Analytics Web General. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

CVE-2020-14530

CVE-2020-14530 affects Oracle Security Service in Oracle Fusion Middleware (11.1.1.9.0). Description: unauthenticated attacker over HTTPS can access data within Oracle Security Service, indicating a confidentiality impact. CVSSv3.1 base score 5.9 (C:H, A:N) with network attack vector and high att...

CVE-2020-14530

Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware component: None. The supported version that is affected is 11.1.1.9.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Security Service. Successfu...

CVE-2020-14644

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

RCE-CVE-2020-5902 BIG-IP F5 Remote Code Execution Descripti...

Oracle Coherence (Apr 2020 CPU)

The version of the tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities, as referenced in the April 2020 Oracle CPU advisory. - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Caching,...

Oracle Coherence (Jan 2020 CPU)

The version of the tested product installed on the remote host is prior to tested version. It is, therefore, affected by a remote code execution vulnerability, as referenced in the January 2020 Oracle CPU advisory. Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware componen...

Security Bulletin: Multiple vulnerabilities affects IBM Engineering Requirements Management DOORS Next

Summary There are multiple vulnerabilities that affects IBM Engineering Requirements Management DOORS Next, called before Rational DOORS Next Generation Vulnerability Details CVEID: CVE-2016-10328 DESCRIPTION: Freetype 2 is vulnerable to a heap-based buffer overflow, caused by an out-of-bounds...

IBM MQ Denial of Service Vulnerability (CNVD-2020-34988)

IBM MQ IBM WebSphere MQ is a messaging middleware product from IBM. The product is mainly for the service-oriented architecture SOA to provide a reliable and proven messaging backbone. A security vulnerability exists in the data transformation logic in IBM MQ. An attacker could exploit this...

Untrusted users able to run pending migrations in production

There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production. This vulnerability has been assigned the CVE identifier CVE-2020-8185. Versions Affected: 6.0.0 = 6.0.3.2 Impact ------ Using this issu...

Treck IP stacks contain multiple vulnerabilities

Overview Treck IP stack implementations for embedded systems are affected by multiple vulnerabilities. This set of vulnerabilities was researched and reported by JSOF, who calls them Ripple20. Description Treck IP network stack software is designed for and used in a variety of embedded systems. T...

Reflected XSS in GraphQL Playground

Impact directly impacted: - [email protected] - all unsanitized user input for renderPlaygroundPage all of our consuming packages of graphql-playground-html are impacted: - [email protected] - unsanitized user input to expressPlayground -...

GHSA-4852-VRH7-28RF Reflected XSS in GraphQL Playground

Impact directly impacted: - [email protected] - all unsanitized user input for renderPlaygroundPage all of our consuming packages of graphql-playground-html are impacted: - [email protected] - unsanitized user input to expressPlayground -...

CVE-2020-4038

GraphQL Playground graphql-playground-html NPM package before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Not...

CVE-2020-4038

GraphQL Playground graphql-playground-html NPM package before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Not...