PT-2020-2501 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient access control in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via IIOP...

PT-2020-2210 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: The issue is related to the failure to protect the web page structure, allowing for cross-site...

PT-2020-2537

Name of the Vulnerable Software and Affected Versions Java SE versions 7u251, 8u241, 11.0.6, and 14 Java SE Embedded version 8u241 Description The issue is related to insufficient access control in the Libraries component of Java SE and Java SE Embedded, allowing an unauthenticated attacker with...

PT-2020-2057 · Microsoft · Sharepoint Server +1

Name of the Vulnerable Software and Affected Versions: SharePoint Server affected versions not specified SharePoint Foundation affected versions not specified SharePoint Enterprise Server affected versions not specified Description: The issue is related to the failure to protect the web page...

PT-2020-6522 · Sonatype · Sonatype Nexus Repository +1

Name of the Vulnerable Software and Affected Versions: Sonatype Nexus Repository versions prior to 3.21.2 Description: The issue is related to incorrect code generation management in the Sonatype Nexus Repository Manager, which can be exploited by a remote attacker to execute arbitrary code by...

PT-2020-2146 · Videolabs +1 · Libmicrodns +1

Name of the Vulnerable Software and Affected Versions: Videolabs libmicrodns version 0.1.0 Description: The issue is related to a denial-of-service vulnerability in the message-parsing functionality of libmicrodns. It occurs when parsing mDNS messages, as the implementation does not properly trac...

PT-2020-10142 · Red Hat · Openshift/Mediawiki-Apb

Name of the Vulnerable Software and Affected Versions: openshift/mediawiki-apb versions prior to 4.3.0 Description: A vulnerability was found in the container openshift/mediawiki-apb, where an insecure modification vulnerability in the /etc/passwd file allows an attacker with access to the...

PT-2020-11911 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.4 through 12.8.1 Description: The issue allows Directory Traversal, which leads to arbitrary file read. A particular endpoint was vulnerable to a directory traversal vulnerability. Recommendations: For GitLab versions 10.4...

PT-2020-12069 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS attacks. This can be exploited in admin/add-user.php by adding a question mark ? followed ...

PT-2020-11982 · Phpgurukul · Phpgurukul Online Book Store

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Book Store version 1.0 Description: An unauthenticated file upload issue has been identified in the admin add.php file. This could be exploited by a remote attacker to upload content, including PHP files, potentially leading...

PT-2020-6867 · D Link · Dch-M225

Name of the Vulnerable Software and Affected Versions: D-Link DCH-M225 versions 1.05b01 and earlier Description: The issue is related to the lack of proper sanitization of special elements used in the operating system command when processing the media renderer parameter in the name string. This...

PT-2020-20566 · Proftpd +2 · Proftpd +2

Name of the Vulnerable Software and Affected Versions: ProFTPD version 1.3.7 Description: The issue is an out-of-bounds OOB read vulnerability in the mod cap module via the cap to text function in cap text.c. Recommendations: For ProFTPD version 1.3.7, consider disabling the mod cap module until ...

PT-2020-6890 · Abb · Abb Esoms

Name of the Vulnerable Software and Affected Versions: ABB eSOMS versions 4.0 to 6.0.3 Description: The issue is related to the use of medium strength ciphers in ABB eSOMS, which could allow an attacker to eavesdrop and/or intercept connections. This could potentially lead to the disclosure of...

PT-2020-19472 · Hashicorp · Nomad Enterprise +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions prior to 0.10.3 Description: The issue allows unbounded resource usage and is susceptible to unauthenticated denial of service. This affects the HTTP/RPC services. Recommendations: For versions...

Explained: the strengths and weaknesses of the Zero Trust model

In a US court of law, the accused are deemed to be innocent until proven guilty. In a Zero Trust security model, the opposite is true. Everything and everyone must be considered suspect—questioned, investigated, and cross-checked—until we can be absolutely sure it is safe to be allowed. Zero Trus...

PT-2020-20130 · Elementor · Elementor

Name of the Vulnerable Software and Affected Versions: Elementor plugin versions prior to 2.8.5 Description: The issue is related to a reflected XSS vulnerability on the elementor-system-info page. This can be exploited by targeting an authenticated user. Recommendations: For versions prior to...

PT-2020-6312 · Libvirt +8 · Libvirt +8

Name of the Vulnerable Software and Affected Versions: libvirt versions 3.10.0 through 5.x Description: A NULL pointer dereference was found in the libvirt API for fetching a storage pool based on its target path. This flaw affects storage pools created without a target path, such as network-base...

PT-2020-19480 · Simplejobscript.Com · Sjs

Name of the Vulnerable Software and Affected Versions: Simplejobscript.com SJS versions prior to 1.65 Description: An issue was discovered in Simplejobscript.com SJS. There is unauthenticated SQL injection via the search engine, specifically through the landing location parameter in the...

Microsoft Internet Explorer Scripting Engine memory corruption vulnerability

Overview The Microsoft Internet Explorer Scripting Engine contains a memory corruption vulnerability, which can allow a remote, unauthenticated attacker to execute arbitrary code. Description Microsoft Internet Explorer contains a scripting engine, which handles execution of scripting languages...

PT-2020-18488 · Phpgurukul · Phpgurukul Small Crm

Name of the Vulnerable Software and Affected Versions: PHPGurukul Small CRM version 2.0 Description: The issue concerns an authentication bypass via SQL injection when logging into the administrator login page. This allows unauthorized access, potentially leading to further malicious activities...