CVE-2020-13277

Removed by vendor...

EAP: XXE issue in TransformerFactory

It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed...

The vulnerability of the application policy configuration of Cisco Firepower Threat Defense allows a attacker to gain read access to data.

The vulnerability of Cisco Firepower Threat Defense’s application policy configuration is related to lack of access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read-only access to data by creating traffic on the vulnerable device...

The vulnerability of the User Interface sub-component of the Oracle Financial Services Profitability Management banking analytics system’s simulation model allows attackers to create, delete, or modify access rights to protected information, or gain read-only access to data.

The vulnerability of the User Interface sub-component of the Oracle Financial Services Profitability Management banking analytics system’s simulation model application relates to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to create, delete,...

The vulnerability of the User Interface sub-component of the Oracle Financial Services Hedge Management and IFRS Valuations banking analytical system’s simulation model applications allows attackers to create, delete, or modify access rights to protected information, or gain read-only access to data.

The vulnerability of the User Interface sub-component of the Oracle Financial Services Hedge Management and IFRS Valuations banking analytical system’s simulation model applications is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor t...

CVE-2020-13253

An out-of-bounds read-access flaw was found in the SD Memory Card emulator of the QEMU. This flaw occurs while performing block write commands via sdhciwrite, if a guest user has sent an 'address' which is out-of-bounds of 's-wpgroups'. A guest user or process may use this flaw to crash the QEMU...

UBUNTU-CVE-2020-8021

a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5...

CVE-2020-12737

An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. Authenticated users can perform a path traversal using double escaped characters, enabling read access to arbitrary files on the server...

Path traversal

An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. Authenticated users can perform a path traversal using double escaped characters, enabling read access to arbitrary files on the server...

CVE-2020-3187

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...

CVE-2020-3256 Cisco Hosted Collaboration Mediation Fulfillment XML External Expansion Vulnerability

A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment HCM-F Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker would need...

CVE-2020-2188

A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

PT-2020-15402 · Jenkins · Jenkins Amazon Ec2 Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier Description: A missing permission check in form-related methods of the Jenkins Amazon EC2 Plugin allows users with Overall/Read access to enumerate credentials IDs of credentials stored in...

gvfs: mishandling of file ownership in daemon/gvfsbackendadmin.c

It was discovered that gvfs incorrectly set the ownership of files handled by the admin:// backend. An attacker could abuse this flaw when the destination file of a copy/move operation is handled by the admin:// backend. The attacker would have access to the target files with the ability to read...

Unspecified Vulnerability in Oracle Java SE JSSE Component (CNVD-2020-72708)

Oracle Java SE is a for developing and deploying Java applications for desktops, servers, and embedded devices and real-time environments. A security vulnerability exists in the JSSE component in Oracle Java SE versions 11.0.6 and 14. An attacker could exploit the vulnerability to gain unauthoriz...

Oracle Java SE 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1 Multiple Vulnerabilities (Apr 2020 CPU) (Unix)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 261, 8 Update 251, 11 Update 7, or 14 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components : - Oracle Java SE and Java SE Embedded are...

CVE-2020-2952

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: Web Listener. The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful...

CVE-2020-2912

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft component: Self-Service. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS...

CVE-2020-2865

Vulnerability in the Oracle Configurator product of Oracle Supply Chain component: Installation. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful...

CVE-2020-2778

Vulnerability in the Java SE product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability...