Authentication flaw

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build numbe...

CVE-2020-24786

CVE-2020-24786 affects multiple ManageEngine products (Exchange Reporter Plus, AD360, ADSelfService Plus, DataSecurity Plus, RecoverManager Plus, EventLog Analyzer, ADAudit Plus, O365 Manager Plus, Cloud Security Plus, ADManager Plus, Log360) with a remotely accessible Java servlet (com.manageeng...

CVE-2020-16142

The CVE pertains to Mercedes-Benz C‑Class AMG Premium Plus (C220 BlueTec) where the COMAND infotainment Bluetooth stack mishandles %x and %c format-string specifiers in a device name. Affected component: Bluetooth stack in the COMAND infotainment software. Root cause: improper handling of format-...

SQL Injection Vulnerability in Chengdu Newline Plus Technology Co.

Chengdu New Line Plus Technology Co., Ltd. is a company that provides website construction and internet marketing services for enterprises and institutions in Chengdu. Chengdu New Line Plus Technology Co., Ltd. website building system has a SQL injection vulnerability, which can be exploited by...

ZOHO ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A security vulnerability exists in versions prior to ZOHO ManageEngine ADSelfService Plus build 6003. The vulnerability can be exploited by an attacker to execute code...

CVE-2020-11552

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An...

CVE-2020-11552

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An...

Privilege escalation

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An...

CVE-2020-11552

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An...

CVE-2020-11552

The CVE-2020-11552 vulnerability affects ManageEngine ADSelfService Plus prior to build 6003. It is an elevation-of-privilege flaw where the product does not properly enforce privileges related to a Certificate dialog, potentially allowing an unauthenticated attacker to escalate to SYSTEM on a Wi...

Logic Flaw Vulnerability in Changjitong T+ Standard Edition

Ltd. is a company dedicated to providing platform services, application services, and value-added data services centered on financial and management services for small and medium-sized enterprises in China. A logic flaw vulnerability exists in Changjitong T+ Standard Edition. An attacker can...

IBM Spectrum Protect Plus Denial of Service Vulnerability (CNVD-2020-44566)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus hostname Command Injection

The IBM Spectrum Protect Plus SPP administrative console running on the remote host is affected by a remote command injection vulnerability due to improper validation of user-supplied data when processing a 'set hostname' HTTP request. An unauthenticated, remote attacker can exploit this, via a...

Security Bulletin: Information Disclosure in IBM Spectrum Protect Plus (CVE-2020-4565)

Summary IBM Spectrum Protect Plus uses insecure communication between the application and server which could allow an attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2020-4565 DESCRIPTION: IBM Spectrum Protect Plus could allow an attacker to obtain sensitive information...

CVE-2020-4631

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could allow a local user to cause interruption of the service operations. IBM X-Force ID: 185372...

CVE-2020-4631

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could allow a local user to cause interruption of the service operations. IBM X-Force ID: 185372...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could allow a local user to cause interruption of the service operations. IBM X-Force ID: 185372...

CVE-2020-4631

Summary of CVE-2020-4631 (IBM Spectrum Protect Plus) : Affects IBM Spectrum Protect Plus versions 10.1.0–10.1.6. In Windows, agent files in non-default configurations have permissions allowing access to everyone with full control, enabling a local user to potentially interrupt service operations....

CVE-2020-4631

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could allow a local user to cause interruption of the service operations. IBM X-Force ID: 185372...

Security Bulletin: Vulnerabilities in Node.js affect IBM Spectrum Protect Plus (CVE-2020-10531, CVE-2020-8172, CVE-2020-8174, CVE-2020-11080)

Summary Node.js is vulnerable to buffer overflows, bypass of security restrictions, and denial of service which may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-10531 DESCRIPTION: International Components for Unicode ICU for C/C++ is vulnerable to a heap-based buffer...