718 matches found
MISP cross-site scripting vulnerability (CNVD-2021-07507)
MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in MISP version 2.4.128. The vulnerability ste...
Veritas System Recovery Security Breach
Veritas System Recovery is a system recovery software from Veritas, USA. The software provides Windows systems with the ability to recover corrupted systems without reinstalling the system. A security vulnerability exists in Veritas System Recovery before 21.2, which can be exploited by an attack...
Vulnerability fixed in F5 BIG-IP
F5 Networks has fixed a vulnerability in a limited number of BIG-IP platforms. The vulnerability allows a malicious party with network access to the vulnerable system may be able to retrieve TCP sequence numbers used in previous, independent TCP connections. These sequence numbers can be used by...
PT-2020-18894 · Google +1 · Libprotobuf +1
Name of the Vulnerable Software and Affected Versions: Valve's Game Networking Sockets versions prior to v1.2.0 Description: The issue arises from improper handling of inlined statistics messages in the CConnectionTransportUDPBase::Received Data function, leading to an exception thrown from...
bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...
bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip...
SDL: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c
SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDLblit1.c...
Unspecified Vulnerability in CloudBees Jenkins Repository Connector Plugin
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Repository Connector Plugin is used in one of...
CVE-2020-25004
Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2 and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation the TLS server always uses wrong data in place of an encryption key derived from an application.
...
Tiki Cross-Site Scripting Vulnerability (CNVD-2020-44400)
Tiki is a suite of open source content management and portal applications from the Tiki community that can be used to create web applications, portals, corporate intranets, extranets, and more. A cross-site scripting vulnerability exists in versions prior to Tiki 21.2. The vulnerability stems fro...
PT-2020-20843 · Apple +7 · Ipados +13
Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 13.6 Apple iPadOS versions prior to 13.6 Apple tvOS versions prior to 13.4.8 Apple watchOS versions prior to 6.2.8 Apple Safari versions prior to 13.1.2 Apple iTunes for Windows versions prior to 12.10.8 Apple iClo...
Apple Safari, iOS and iPadOS iAP Component Input Validation Vulnerability
Apple Safari is a web browser that is the default browser that comes with the Mac OS X and iOS operating systems.Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for iPad tablets.... Apple iPadOS is an operating system for the iPad tablet computer....
CVE-2020-14699
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Orac...
PT-2020-14477 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE versions 11.3 through 13.1.2 Description: The issue is related to Incorrect Access Control in GitLab EE due to the Maven package upload endpoint. This allows for unauthorized access. Recommendations: For GitLab EE versions 11.3...
Heybbs 1.2 no***_de***.php file has SQL injection vulnerability
HEYBBS micro-community is a front-end based on bootstrap+jq+css, back-end php+mysql development of micro-community program. A SQL injection vulnerability exists in the Heybbs 1.2 node.php file, which can be exploited by an attacker to obtain sensitive information from the database...
Palo Alto Networks PAN-OS Formatting String Error Vulnerability (CNVD-2020-22957)
Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. A Formatting String Error vulnerability exists in the Varrcvr daemon in PAN-OS version 9.0 prior to 9.0.7 and version 9.1 prior to 9.1.2 in Palo Alto Networks. A remote attacker could...
BuddyPress Access Control Error Vulnerability
BuddyPress is a plugin suite that turns WordPress into a social networking site. An Access Control Error vulnerability exists in BuddyPress versions prior to 5.1.2. The vulnerability stems from a network system or product that does not properly restrict access to resources from unauthorized roles...
Adobe After Effects Buffer Overflow Vulnerability
Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. A buffer overflow vulnerability exists in Adobe After Effects 16.1.2 and...