HCL OneTest 授权问题漏洞

HCL OneTest is a software testing tool from HCL India that provides multiple testing options. The software supports API testing, functional testing, UI testing, performance testing and service virtualization to support software automation testing. An authorization issue vulnerability exists in HC...

CVE-2020-14221

HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users...

PT-2020-16754 · Teclib +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.3 Description: The issue is related to an Insecure Direct Object Reference IDOR vulnerability in the ajax/comments.php file. This vulnerability allows an attacker to read data from any database table, such as glpi...

ALPINE-CVE-2020-25696

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating...

HCL Technologies Digital Experience Cross-Site Scripting Vulnerability

HCL Technologies Digital Experience is a suite of digital experience platforms, content delivery solutions from HCL Technologies India. HCL Digital Experience versions 8.5, 9.0, 9.5 have a cross-site scripting vulnerability where a sub-component is susceptible to an XSS attack where in the...

HCL Digital Experience Cross-Site Scripting Vulnerability

HCL Technologies Digital Experience is a suite of digital experience platforms, content delivery solutions from HCL Technologies India. A cross-site scripting vulnerability exists in HCL Digital Experience version 8.5, 9.0, 9.5. The vulnerability stems from the lack of proper validation of...

GLPI Information Disclosure Vulnerability (CNVD-2020-67241)

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

GHSA-X56P-C8CG-Q435 Open Redirect in Next.js versions

Impact - Affected: Users of Next.js between 9.5.0 and 9.5.3 - Not affected: Deployments on Vercel https://vercel.com are not affected - Not affected: Deployments using next export We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. Patches...

UBUNTU-CVE-2020-11031

In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The librar...

ALEOS Out-of-Bounds Read Vulnerability

ALEOS is an integrated development environment for building customized embedded M2M applications. An out-of-bounds read vulnerability exists in the ACEView service in ALEOS versions prior to 4.13.0, 4.9.5, and 4.4.9, which can be exploited by an attacker to obtain sensitive information...

DEBIAN-CVE-2020-16289

A buffer overflow vulnerability in cifprintpage in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51...

PT-2020-4343 · Teclib +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.1 Description: The issue is related to the Clone feature in the GLPI system, which is vulnerable due to incorrect neutralization of special elements used in SQL queries. This allows a remote attacker to execute...

Huawei NIP6800, Secospace USG6600 and USG9500 Memory Leak Vulnerabilities (CNVD-2020-36723)

Huawei USG9500 and others are products of Huawei, China.USG9500 is a data center firewall product.NIP6800 is an intrusion prevention system.Secospace USG6600 is a next-generation firewall product. A security vulnerability exists in the Huawei NIP6800, Secospace USG6600, and USG9500. An attacker...

PT-2020-12529

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 9.0.0 through 9.5.16 TYPO3 CMS versions 10.0.0 through 10.4.1 Description A same-site request forgery vulnerability has been discovered in the backend user interface and install tool of TYPO3 CMS. This vulnerability can be...

PT-2020-12525 · Typo3 · Typo3/Cms

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.16 TYPO3 CMS versions 10.0.0 through 10.4.1 Description: A cross-site scripting issue has been discovered in the HTML placeholder attributes, which contain data from other database records. This issue can ...

CVE-2020-7132

A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely exploited to allow Reflected Cross Site Scripting. HPE has made the following software updates and mitigation information to resolve the vulnerability in HPE Onboard...

DNN Information Disclosure Vulnerability

DNN also known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. DNN formerly DotNetNuke 9.5 version of the embedded...

PT-2020-10293 · Intland · Codebeamer Alm

Name of the Vulnerable Software and Affected Versions: Intland codeBeamer ALM versions 9.5 and earlier Description: The issue is related to stored XSS via the Trackers Title parameter. This allows for malicious code to be stored and executed when a user views the affected page. There is no...

PT-2020-6581

Name of the Vulnerable Software and Affected Versions Ansible versions 2.7.16 and prior Ansible versions 2.8.8 and prior Ansible versions 2.9.5 and prior Description A flaw was found in Ansible when a password is set with the argument password of the svn module, it is used on the svn command line...

HPE OneView for VMware vCenter Cross-Site Scripting Vulnerability

HPE OneView for VMware vCenter is a VMware vCenter server management software plug-in for managing HPE ProLiant servers and storage systems from Hewlett Packard Enterprise HPE. A cross-site scripting vulnerability exists in HPE OneView for VMware vCenter version 9.5. The vulnerability stems from ...