SAP NetWeaver UDDI Server Path Traversal Vulnerability

SAP NetWeaver UDDI Server is a UDDI Unified Description, Discovery and Integration directory server from SAP. SAP NetWeaver UDDI Server suffers from a path traversal vulnerability that stems from the program not adequately validating path information submitted by the user. An attacker could explo...

Trend Micro Fixes Critical Flaws Under Attack

Trend Micro has released security updates patching five vulnerabilities in its endpoint security solutions, Apex One and OfficeScan XG for Windows. Specifically, Apex One 2019 and OfficeScan XG SP1 and XG are affected by four critical-severity and one high-severity flaws. Two of these...

The vulnerability of the server software Wowza Streaming Engine, related to errors in the use of standard permissions, allows a violator to execute arbitrary code.

The vulnerability of the server software Wowza Streaming Engine is related to errors in the use of standard permissions. Exploiting this vulnerability allows an attacker to execute arbitrary code by introducing malware into one of these files located in the directory...

The vulnerability of the HTTP/2 network protocol implementation in the Apache HTTP Server allows a attacker to trigger a service failure.

The vulnerability of the HTTP/2 network protocol implementation in the Apache HTTP Server is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

CVE-2020-0795

This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint...

CVE-2019-9101

An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. Sensitive information is sent to the web server in cleartext, which may allow an attacker to discover the credentials if they...

Microsoft Windows and Windows Server Elevation of Privilege Vulnerability (CNVD-2020-19010)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows and Windows Server,...

CVE-2020-0050

In nfahciusendmsg of nfahciutils.cc, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege in the NFC server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2020-2147

A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials...

Cross-site scripting vulnerability in multiple Lexmark products (CNVD-2020-19522)

The Lexmark CS31x, among others, is a printer from Lexmark USA. A cross-site scripting vulnerability exists in the web server built into several Lexmark products, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute...

Cross-Site Scripting Vulnerability in Multiple Lexmark Products

The Lexmark CS31x, among others, is a printer from Lexmark USA. A cross-site scripting vulnerability exists in the web server built into several Lexmark products, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute...

Command Execution Vulnerability Exists in OpenSMTPD's

OpenSMTPD is a free implementation of the server-side SMTP protocol , and provides some additional standard extensions . OpenSMTPD's suffers from a command execution vulnerability. An attacker can execute arbitrary shell commands on a vulnerable OpenSMTPD installation...

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

A flaw was found in Netty before version 4.1.44, where it accepted multiple Content-Length headers and also accepted both Transfer-Encoding, as well as Content-Length headers where it should reject the message under such circumstances. In circumstances where Netty is used in the context of a...

UBUNTU-CVE-2020-8794

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mtaio in mtasession.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce...

New OpenSMTPD RCE Flaw Affects Linux and OpenBSD Email Servers

OpenSMTPD has been found vulnerable to yet another critical vulnerability that could allow remote attackers to take complete control over email servers running BSD or Linux operating systems. OpenSMTPD , also known as OpenBSD SMTP Server, is an open-source implementation of the Simple Mail Transf...

SUSE-SU-2020:0454-1 Security update for nodejs8

This update for nodejs8 fixes the following issues: Security issues fixed: - CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string CVE-2019-15604, bsc1163104. - CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed...

The vulnerability of the Server:InnoDB component of the Oracle MySQL database management system allows a attacker to cause a service failure.

The vulnerability of the Server:InnoDB component in the Oracle MySQL database management system is related to an uncontrolled consumption of system resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

SSH Brute Force Login Attempt

A remote attacker can exploit this vulnerability by using brute force login attempt. Successful exploitation would allow an attacker to gain unauthorized access to the server...

Multiple Microsemi Product Path Traversal Vulnerabilities

Microsemi Symmetricom SyncServer S100 and others are a network time server from Microsemi, USA. A path traversal vulnerability exists in multiple Microsemi products. The vulnerability stems from a failure of a networked system or product to properly filter special elements in a resource or file...

Microsoft Exchange Authentication Key Remote Code Execution Vulnerability

Microsoft Exchange Server is a set of e-mail service programs from Microsoft, which provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. Microsoft Exchange Server suffers from a remote code execution vulnerability that stems from the program's failure to proper...