Microsoft Windows and Microsoft Windows Server Elevation of Privilege Vulnerability (CNVD-2020-13562)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows and Microsoft Windows...

The vulnerability of Siemens industrial switches SCALANCE X-200, SCALANCE X-200IRT, and SCALANCE X-300’s web servers allows attackers to execute cross-site scripting attacks.

The vulnerability of Siemens industrial switches SCALANCE X-200, SCALANCE X-200IRT, and SCALANCE X-300 relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

Remote code execution

Biscom Secure File Transfer SFT before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server...

Code injection

A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer...

CVE-2020-2679

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2019-4636

IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013...

Vulnerability of the Server component: The Information Schema of the MySQL Server database management system, which allows attackers to gain unauthorized access to protected information.

Vulnerability of the MySQL Server component: The information schema of the MySQL Server database management system is vulnerable due to lack of access control mechanisms. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using the HTTP protoc...

CVE-2018-8654

An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'...

CVE-2018-8654

An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'...

Remote code execution

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server...

Path traversal

In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence dossier=../ and servletrecuperefichier document=../ allows an unauthenticated user to download arbitrary files from the server...

The vulnerability of the IBM Spectrum Protect software server, which allows a intruder to gain unauthorized access to protected information.

The vulnerability of the IBM Spectrum Protect software platform’s data protection server is related to deficiencies in the storage of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information through...

Exploit for CVE-2020-2551

Twitter: @Hktalent3135773...

Razer: Improper access control on easytopup.in.th transaction page leads to user's information disclosure and may lead to account hijacking

The tester discovered a Razer Gold Thailand server was vulnerable to information disclosure due to the use of a predicable reference ID in application URLs which could lead to the ability obtain phone numbers. Razer thanks the tester for his clear report...

CVE-2019-19801

In Gallagher Command Centre Server versions of v8.10 prior to v8.10.1134MR4, v8.00 prior to v8.00.1161MR5, v7.90 prior to v7.90.991MR5, v7.80 prior to v7.80.960MR2 and v7.70 or earlier, an unprivileged but authenticated user is able to perform a backup of the Command Centre databases...

CVE-2020-2580

CVE-2020-2580 – MySQL Server (Oracle MySQL) – DDL vulnerability . The vulnerability affects MySQL Server component: Server: DDL in 8.0.17 and earlier. A high-privilege attacker who can reach the server over the network via multiple protocols can exploit this to cause a hang or a near-frequent cra...

PT-2020-1535 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 Description: The issue is related to inadequate access control in the Console component of Oracle WebLogic Server, allowing an unauthenticated attacker with networ...

PT-2020-1461 · Mysql Server +6 · Mysql Server +6

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.18 and prior Description: The issue is related to errors in resource release in the MySQL Server product, specifically in the Server: DML component. It allows a high-privileged attacker with network access via multip...

CVE-2020-6836

grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may...

CVE-2018-2784

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...