CVE-2020-14638

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Sample apps. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2020-14575

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

UBUNTU-CVE-2020-14540

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

UBUNTU-CVE-2020-14663

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2020-14702

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2020-14539

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

Exploit for Improper Input Validation in Microsoft

It is an offensive tool for IIS. The repository contains a proof-of-concept PoC exploit for CVE-2020-1350, a vulnerability in IIS. The target product/service is IIS, and the vulnerability class/vector is unspecified. The probable entry point is the .vs/CVE-2020-1350/config/applicationhost.config...

The vulnerability of the coTURN server function, which allows a perpetrator to gain unauthorized access to protected information

The vulnerability of the coTURN server function is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Cross site scripting

A Cross-site Scripting XSS vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'...

The vulnerability of the automated information system “Web-Torghi KS” arises from the lack of measures taken to protect the structure of the web page. This allows attackers to upload arbitrary files onto the AIIS server.

The vulnerability of the automated information system “Web-Torghi KS” is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to upload arbitrary files to the AIIS server using a specially created POST request...

Siemens SICAM MMU, SICAM T, and SICAM SGU

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SICAM MMU, SICAM T and SICAM SGU Vulnerabilities: Out-of-bounds Read, Missing Authentication for Critical Function, Missing Encryption of Sensitive Data, Use of Password Hash wit...

Directory traversal

An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal...

Arbitrary File Deletion Vulnerability in Cscms of Guilin Chongsheng Network Technology Company Limited (CNVD-2020-47298)

Cscms is a multi-functional network information management system developed by Chongsheng Network Technology. Cscms has an arbitrary file deletion vulnerability that can be exploited by an attacker to delete arbitrary files from the server...

Authorization Bypass

jetty-server is vulnerable to authorization bypass. The vulnerability exists as a buffer corruption could occur when the response buffer is too large, allowing the header buffer to be released, but not nulled, causing the server to send incorrect responses to different clients...

kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service

A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a "billion laughs" attack. The highest threat from this vulnerability is to system availability...

tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability

CVE-2020-1938 is a file read/inclusion vulnerability in the AJP connector in Apache Tomcat. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instance...

CVE-2020-14983

The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled numplayers value, leading to a buffer overflow. A malicious user can overwrite the server's stack...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-35189)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.23.0 that can be exploited by an attacker to cause a denial of service infinite loop...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-35365)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.13.0, which can be exploited by an attacker non-member to obtain a team's slash / commands...

Mattermost Server Cross-Site Scripting Vulnerability

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A cross-site scripting vulnerability exists in Mattermost Server versions prior to 3.6.0 and prior to 3.5.2. The vulnerability stems from a lack of proper validation of client-side data by the WEB...