Bitrix24 Code Issue Vulnerability

Bitrix24 is a suite of enterprise social platforms from Bitrix USA. The platform includes features such as online communication, calendar management and CRM Customer Relationship Management. A code issue vulnerability exists in Bitrix24 version 20.0.975 and prior versions. The vulnerability stems...

The vulnerability of the Microsoft Dynamics 365 customer relationship management system, related to the lack of measures taken to protect the website structure, allows a hacker to perform a cross-site scripting attack.

The vulnerability of the Microsoft Dynamics 365 customer relationship management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2020-13765

romcopy in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation...

The vulnerability of the Preferences sub-component of the Oracle CRM Technical Foundation component of the Oracle E-Business Suite allows a perpetrator to gain access to and modify data.

The vulnerability of the Preferences sub-component of the Oracle CRM Technical Foundation component of the Oracle E-Business Suite system relates to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to read,...

The vulnerability of the Preferences component of the Oracle CRM system’s customer relationship management module. The Oracle E-Business Suite technical foundation for automating business processes, allowing attackers to access, modify, add, or delete data.

The vulnerability of the Preferences component of the Oracle CRM system’s customer relationship management module is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data using the HTTP protocol...

Authorization Bypass

Red Hat Enterprise MRG is vulnerable to authorization bypass. The Management Console Installation Guide for Red Hat Enterprise MRG 1.3 instructed administrators to configure Condor to allow the MRG Management Console cumin to submit jobs on behalf of a user. This configuration facilitated a trust...

Defender Behavior in 2019

Security is a team sport, or at least it should be. Given the constant behavior evolution we see from attackers and the vast IT footprint attackers can target, IT and security teams clearly face an uphill battle. Whereas attackers only have to be right once to succeed, defenders must be right 100...

IBM Tivoli Netcool/OMNIbus WebGUI Relationship Cross-Site Request Forgery Vulnerability

IBM Tivoli Netcool/OMNIbusGUI is a graphical user interface for the IBM Tivoli Netcool/OMNIbus service level management system from IBM USA. A cross-site request forgery vulnerability exists in the administrator page in the IBM Tivoli Netcool/OMNIbus WebGUI Relationship. The vulnerability stems...

Invalid role for specified account. Status code: Forbidden

Challenge When attempting to add a custom role in the Veeam Backup for AWS console, the following error occurs: Invalid role for specified account. Status code: Forbidden Log snippet: Info CDefaultAmazonStsInfrastructure Assuming role 'arn:aws:iam::xyz:role/customrole'. Error TryInvokeAsync...

Multiple SQL Injection Vulnerabilities in SuiteCRM

SuiteCRM is a free and open source customer relationship management application. Multiple SQL injection vulnerabilities exist in SuiteCRM. An attacker could exploit to obtain sensitive information...

Oracle E-Business Suite Unauthorized Access Vulnerability (CNVD-2020-04015)

Oracle E-Business Suite is based on the original Application ERP expansion, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management and so on a variety of management software collection, is a seamless integration of a management suite. Oracle...

The vulnerability of the SAP Supplier Relationship Management procurement automation application, related to errors in the encoding of user-input data, allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the SAP Supplier Relationship Management procurement automation application is related to errors in the encoding of user-input data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2019-20334

In Netwide Assembler NASM 2.14.02, stack consumption occurs in expr functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 and stdscan in asm/stdscan.c. This is similar to CVE-2019-6290 and CVE-2019-6291...

NewStart CGSL CORE 5.05 / MAIN 5.05 : unzip Vulnerability (NS-SA-2019-0234)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has unzip packages installed that are affected by a vulnerability: - Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size...

SAP Supplier Relationship Management Cross-Site Scripting Vulnerability (CNVD-2020-04284)

SAP Supplier Relationship Management SRM is a supplier relationship management solution from SAP. The product automates purchasing and acquisition processes within an organization and between suppliers, and provides functions such as invoicing. A cross-site scripting vulnerability exists in SAP S...

Our Communication Strategy to Help Development Make the Switch to Kubernetes

VMware Carbon Black has acquired a lot of technology as it has grown. That means we have a lot of different tooling in play that is both costly and complex to manage. Our VP of Engineering recognized this and created a new team specifically tasked with creating a unified system infrastructure and...

CVE-2019-19306

The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName...

Secondary storage backup stops working after NetApp MetroCluster switchover

Challenge After the MetroCluster switchover a backup job with the SnapVault or SnapMirror specified on the Secondary Target tab cannot update these relationships. Cause Unfortunately this is a bug in the OnTap Data Management software. In the event of a switchover Veeam Backup&Replication cannot...

The vulnerability of the Access and Security sub-component of the Hyperion Data Relationship Management application, which is used for data management in the Oracle Hyperion business environment, allows a perpetrator to cause a service failure, execute arbitrary code, or gain unauthorized access to protected information.

The vulnerability of the Access and Security sub-component of the Hyperion Data Relationship Management component of the Oracle Hyperion application for business data management is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to cause service...

Low: unzip

Issue Overview: Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.CVE-2018-18384 Affected Packages: unzip Note: This advisory is...