9394 matches found
XML External Entity (XXE)
plonesupermodel is vulnerable to XML external entity XXE attacks. The vulnerability exists due to an unapplied permission which would allow an attacker with Manager role to perform XXE attacks and submit requests on behalf of the server and access restricted internal or local resources...
CVE-2020-27534: Improper Limitation of a Pathname to a Restricted Directory
util/binfmtmisc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call...
Information Disclosure
odoo is vulnerable to information disclosure. Insecure access controls in mail module notifications allows remote authenticated users to obtain access to arbitrary messages in conversations that are otherwise restricted...
CVE-2019-11785
Improper access control in mail module followers in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscribe to receive future messages...
Odoo Access Control Error Vulnerability
Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python, with PostgreSQL as the database, and includes modules for sales management, inventory management, and financial management. A security vulnerability...
Ansible win_unzip Path Traversal
The vulnerability of the winunzip module in the Ansible configuration management system is related to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of th...
Magento Commerce Path Traversal
The vulnerability of the Magento Commerce development and management software platform is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...
RHEL 8 : postgresql:12 (RHSA-2020:5620)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5620 advisory. PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream...
PT-2020-13587 · Nzxt · Nzxt Cam
Name of the Vulnerable Software and Affected Versions: NZXT CAM version 4.8.0 Description: An information disclosure issue exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality. A specially crafted I/O request packet IRP using the IRP 0x9c4060d0 allows a low-privilege user to...
CVE-2020-0481
In AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a non-system app to send a broadcast it shouldn't have permissions to send, with no additional execution privileges needed. User interaction is not needed for...
samba: Missing handle permissions check in SMB1/2/3 ChangeNotify
A flaw was found in the way Samba handled file and directory permissions. This flaw allows an authenticated user to gain access to certain file and directory information, which otherwise would be unavailable. The highest threat from this vulnerability is to confidentiality...
About the security content of iOS 14.0 and iPadOS 14.0 - Apple Support
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...
EulerOS 2.0 SP5 : pcp (EulerOS-SA-2020-2557)
According to the versions of the pcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE...
Adobe Reader Path Traversal
The vulnerability of the Adobe Reader text viewer is related to errors that occur when restricting access to the path to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to gain access to protected information in the context of the current user...
SAP AS ABAP and SAP S4 HANA Improper Authentication Vulnerabilities
SAP Netweaver is a service-oriented, integrated application platform from SAP, which provides a development and runtime environment for SAP applications. The platform mainly provides development and operation environment for SAP applications.ABAP is an application server running in NetWeaver and...
DEBIAN-CVE-2020-8177
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used...
PT-2020-17218
Name of the Vulnerable Software and Affected Versions watchOS versions prior to 7.2 macOS Big Sur versions prior to 11.1 macOS Catalina versions prior to Security Update 2020-001 macOS Mojave versions prior to Security Update 2020-007 iOS versions prior to 14.3 iPadOS versions prior to 14.3 tvOS...
CVE-2020-8919
An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with...
CVE-2020-26832
SAP AS ABAP SAP Landscape Transformation, versions - 20111620, 20111640, 20111700, 20111710, 20111730, 20111731, 20111752, 2020 and SAP S4 HANA SAP Landscape Transformation, versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should b...