Command Execution Vulnerability Exists in OpenSMTPD's

OpenSMTPD is a free implementation of the server-side SMTP protocol , and provides some additional standard extensions . OpenSMTPD's suffers from a command execution vulnerability. An attacker can execute arbitrary shell commands on a vulnerable OpenSMTPD installation...

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

A flaw was found in Netty before version 4.1.44, where it accepted multiple Content-Length headers and also accepted both Transfer-Encoding, as well as Content-Length headers where it should reject the message under such circumstances. In circumstances where Netty is used in the context of a...

UBUNTU-CVE-2020-8794

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mtaio in mtasession.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce...

New OpenSMTPD RCE Flaw Affects Linux and OpenBSD Email Servers

OpenSMTPD has been found vulnerable to yet another critical vulnerability that could allow remote attackers to take complete control over email servers running BSD or Linux operating systems. OpenSMTPD , also known as OpenBSD SMTP Server, is an open-source implementation of the Simple Mail Transf...

SUSE-SU-2020:0454-1 Security update for nodejs8

This update for nodejs8 fixes the following issues: Security issues fixed: - CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string CVE-2019-15604, bsc1163104. - CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed...

The vulnerability of the Server:InnoDB component of the Oracle MySQL database management system allows a attacker to cause a service failure.

The vulnerability of the Server:InnoDB component in the Oracle MySQL database management system is related to an uncontrolled consumption of system resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

SSH Brute Force Login Attempt

A remote attacker can exploit this vulnerability by using brute force login attempt. Successful exploitation would allow an attacker to gain unauthorized access to the server...

Multiple Microsemi Product Path Traversal Vulnerabilities

Microsemi Symmetricom SyncServer S100 and others are a network time server from Microsemi, USA. A path traversal vulnerability exists in multiple Microsemi products. The vulnerability stems from a failure of a networked system or product to properly filter special elements in a resource or file...

Microsoft Exchange Authentication Key Remote Code Execution Vulnerability

Microsoft Exchange Server is a set of e-mail service programs from Microsoft, which provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. Microsoft Exchange Server suffers from a remote code execution vulnerability that stems from the program's failure to proper...

Microsoft Windows and Microsoft Windows Server Elevation of Privilege Vulnerability (CNVD-2020-13562)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows and Microsoft Windows...

The vulnerability of Siemens industrial switches SCALANCE X-200, SCALANCE X-200IRT, and SCALANCE X-300’s web servers allows attackers to execute cross-site scripting attacks.

The vulnerability of Siemens industrial switches SCALANCE X-200, SCALANCE X-200IRT, and SCALANCE X-300 relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

Remote code execution

Biscom Secure File Transfer SFT before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server...

Code injection

A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer...

CVE-2020-2679

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2019-4636

IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013...

Vulnerability of the Server component: The Information Schema of the MySQL Server database management system, which allows attackers to gain unauthorized access to protected information.

Vulnerability of the MySQL Server component: The information schema of the MySQL Server database management system is vulnerable due to lack of access control mechanisms. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using the HTTP protoc...

CVE-2018-8654

An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'...

CVE-2018-8654

An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'...

Remote code execution

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server...

Path traversal

In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence dossier=../ and servletrecuperefichier document=../ allows an unauthenticated user to download arbitrary files from the server...