Oracle E-Business Intelligence DBI Setup Privilege Escalation

The vulnerability of the DBI Setup component of the Oracle E-Business Intelligence software, a business automation system within the Oracle E-Business Suite, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or...

parc inode permission module Unix sockets Data Compromise

The vulnerability of the parsec inode permission module in the linux-astra-modules package is related to deficiencies in access control for non-functional Unix sockets. Exploiting this vulnerability could allow a malicious actor to compromise data integrity from a remote location...

Secure Boot Protocol Security Monitor XSS

The vulnerability of the security-monitor function in the Secure Boot protocol a part of the UEFI specification is related to an error in the display of ssh for the root user, when this protocol is not enabled for the user. Exploiting this vulnerability can allow a remote attacker to access...

Project Manager Oracle Primavera P6 Unauthorized Access Modification Deletion

The vulnerability of the Project Manager component of the Oracle Primavera P6 Enterprise Project Portfolio Management application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected...

Astra Linux Directory service EPW management system Buffer Overflow DoS

The vulnerability of the Astra Linux Directory Service Management System ALD is related to an error that causes operations to go beyond the memory limit. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

FreeIPA Improper Access Control Data Compromise

The vulnerability of the FreeIPA server is related to a configuration error, where multiple network interfaces are present. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of the data...

SpamAssassin OS Command Injection

The vulnerability of spam filtering systems that use Perl-based text analysis, such as SpamAssassin, is related to incorrect configuration of malicious rules or configuration files, which may have been uploaded from the update server. Exploiting this vulnerability can allow a remote attacker to...

WordPress Content Management System Data Compromise

The vulnerability of the WordPress content management system’s functions is related to an error in the execution of XSS attacks during shortcode rendering. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

Cybozu Garoon contains multiple vulnerabilities

Overview Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. Authentication bypass in the API used to specify the fields CWE-287 - CVE-2020-5563 Cross-site scripting in the application "E-mail" CWE-79 - CVE-2020-5564 Input validation bypass in the applications...

Cybozu Garoon Input Validation Error Vulnerability (CNVD-2020-26658)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. An input validation error vulnerability exists in Cybozu Garoon versions 4.0.0 through 4.10.3. A remote attacker...

CVE-2020-7134

A remote access to sensitive data vulnerability was discovered in HPE IOT + GCP versions: 1.4.0, 1.4.1, 1.4.2, 1.2.4.2...

Google Chrome V8 Memory Leak Confidential Data Access

The vulnerability of Google Chrome’s V8 browser kernel relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

Symfony Input Validation Data Compromise

The vulnerability of the Symfony software development and management platform is related to an application error where unvalidated user input is passed as a file. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...

libvpx Heap Buffer Overflow DoS

The vulnerability of the multimedia library libvpx is related to a memory-bound read error. Exploiting this vulnerability could allow an attacker to gain access to confidential data remotely...

CVE-2020-10903

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network acce...

OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network acce...

CVE-2019-20786

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

Google Chrome CORS Information Disclosure

The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to information through a specially created HTML page...

PT-2020-2597

Name of the Vulnerable Software and Affected Versions Java SE versions 7u251, 8u241, 11.0.6, and 14 Java SE Embedded version 8u241 Description The issue is related to insufficient input validation in the Lightweight HTTP Server component of Oracle Java SE and Java SE Embedded. This can be exploit...