GLPI Information Disclosure Vulnerability (CNVD-2020-67241)

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

GHSA-X56P-C8CG-Q435 Open Redirect in Next.js versions

Impact - Affected: Users of Next.js between 9.5.0 and 9.5.3 - Not affected: Deployments on Vercel https://vercel.com are not affected - Not affected: Deployments using next export We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. Patches...

UBUNTU-CVE-2020-11031

In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The librar...

ALEOS Out-of-Bounds Read Vulnerability

ALEOS is an integrated development environment for building customized embedded M2M applications. An out-of-bounds read vulnerability exists in the ACEView service in ALEOS versions prior to 4.13.0, 4.9.5, and 4.4.9, which can be exploited by an attacker to obtain sensitive information...

DEBIAN-CVE-2020-16289

A buffer overflow vulnerability in cifprintpage in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51...

PT-2020-4343 · Teclib +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.1 Description: The issue is related to the Clone feature in the GLPI system, which is vulnerable due to incorrect neutralization of special elements used in SQL queries. This allows a remote attacker to execute...

Huawei NIP6800, Secospace USG6600 and USG9500 Memory Leak Vulnerabilities (CNVD-2020-36723)

Huawei USG9500 and others are products of Huawei, China.USG9500 is a data center firewall product.NIP6800 is an intrusion prevention system.Secospace USG6600 is a next-generation firewall product. A security vulnerability exists in the Huawei NIP6800, Secospace USG6600, and USG9500. An attacker...

PT-2020-12529 · Typo3 · Typo3/Cms

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.16 TYPO3 CMS versions 10.0.0 through 10.4.1 Description: A same-site request forgery vulnerability has been discovered in the backend user interface and install tool of TYPO3 CMS. This vulnerability can be...

PT-2020-12525 · Typo3 · Typo3/Cms

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.16 TYPO3 CMS versions 10.0.0 through 10.4.1 Description: A cross-site scripting issue has been discovered in the HTML placeholder attributes, which contain data from other database records. This issue can ...

CVE-2020-7132

A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely exploited to allow Reflected Cross Site Scripting. HPE has made the following software updates and mitigation information to resolve the vulnerability in HPE Onboard...

DNN Information Disclosure Vulnerability

DNN also known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. DNN formerly DotNetNuke 9.5 version of the embedded...

PT-2020-10293 · Intland · Codebeamer Alm

Name of the Vulnerable Software and Affected Versions: Intland codeBeamer ALM versions 9.5 and earlier Description: The issue is related to stored XSS via the Trackers Title parameter. This allows for malicious code to be stored and executed when a user views the affected page. There is no...

PT-2020-6581

Name of the Vulnerable Software and Affected Versions Ansible versions 2.7.16 and prior Ansible versions 2.8.8 and prior Ansible versions 2.9.5 and prior Description A flaw was found in Ansible when a password is set with the argument password of the svn module, it is used on the svn command line...

HPE OneView for VMware vCenter Cross-Site Scripting Vulnerability

HPE OneView for VMware vCenter is a VMware vCenter server management software plug-in for managing HPE ProLiant servers and storage systems from Hewlett Packard Enterprise HPE. A cross-site scripting vulnerability exists in HPE OneView for VMware vCenter version 9.5. The vulnerability stems from ...

CVE-2019-17330

The Web server component of TIBCO Software Inc.'s TIBCO EBX contains multiple vulnerabilities that theoretically allow authenticated users to perform stored cross-site scripting XSS attacks, and unauthenticated users to perform reflected cross-site scripting attacks. Affected releases are TIBCO...

CVE-2019-4422

IBM Security Guardium 9.0, 9.5, and 10.6 are vulnerable to a privilege escalation which could allow an authenticated user to change the accessmgr password. IBM X-Force ID: 162768...

Piwigo Cross-Site Scripting Vulnerability (CNVD-2019-32000)

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A cross-site scripting vulnerability exists in admin.php?page=notificationbymail in Piwigo version 2.9.5. The vulnerabili...

IBM Rational DOORS Web Access Cross-Site Scripting Vulnerability (CNVD-2019-15711)

IBM Rational DOORS Web Access is a requirements collaboration solution from IBM USA. The product supports creating, analyzing, editing, and discussing requirements and other A cross-site scripting vulnerability exists in IBM Rational DOORS Web Access versions 9.5.1 through 9.5.2.9 and 9.6 through...

PT-2019-4078 · Postgresql +5 · Postgresql +5

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions 9.5.x up to, excluding 9.5.17 PostgreSQL versions 9.6.x up to, excluding 9.6.13 PostgreSQL versions 10.x up to, excluding 10.8 PostgreSQL versions 11.x up to, excluding 11.3 Description: The issue is related to an error in...

IBM BigFix Platform Clickjacking Vulnerability

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A clickjacking vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.9 and 9.2 through 9.2.14, which can be exploited by remote attackers with the help...