UBUNTU-CVE-2020-1768

The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reached. This issue affects: OTRS 7.0.x version 7.0.14 and prior versions...

DEBIAN-CVE-2020-1765

An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and...

UBUNTU-CVE-2020-1766

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...

WSO2 Identity Server Cross-Site Scripting Vulnerability (CNVD-2020-02585)

WSO2 Identity Server IS is an identity server from the American company WSO2. A cross-site scripting vulnerability exists in WSO2 IS version 5.7.0. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to execut...

Micro Focus ArcSight Logger Cross-Site Request Forgery Vulnerability

Micro Focus ArcSight Logger is a suite of log management software from Micro Focus UK. The software collects and integrates data from any log generation source for log management, searching, indexing, reporting, analysis and retention. A cross-site request forgery vulnerability exists in Micro...

Cloudera CDH Cloudera Search Unauthorized Access Vulnerability

Cloudera CDH is an open source Hadoop platform from Cloudera. The platform provides scalable storage and distributed computing, as well as a Web-based user interface and other enterprise features.Cloudera Search is a program for ... A security vulnerability exists in Cloudera Search in versions o...

CVE-2019-15073

An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities...

CVE-2019-15071

The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting XSS vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of...

CVE-2019-9699

Symantec Messaging Gateway prior to 10.7.0, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data...

CVE-2019-16677

An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF...

CVE-2019-4271

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. IBM X-Force ID: 160243...

CVE-2018-15512

Cross-site scripting XSS vulnerability in the 'Authorisation Service' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML...

Oracle Retail Applications Retail Xstore Office Denial of Service Vulnerability

Oracle Retail Applications is the United States Oracle Oracle company's set of retail applications store solutions. The product includes inventory management, sales management and customer management, etc. Retail Xstore Office is one of the Web-based central management console component. A securi...

PT-2019-11451 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 7.0.0 Description: The issue allows malicious HTML to change user passwords, disable users, and disable password encryption. It is related to the function that handles user password changes, user disablement, and password...

CVE-2019-9957

Stored XSS within Quadbase EspressReport ES ERES v7.0 update 7 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The XSS payload is stored by creating a new user account, and setting the username to an XSS payload. The stored payload c...

CVE-2018-9564

In llcputilparselinkparams of llcputil.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0...

Google Android Framework elevation of privilege vulnerability (CNVD-2019-23120)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation of privilege vulnerability exists in the Framework component of Google Android 7.0, 7.1.1, 7.1.2, 8.0, and 8.1. An attacker can exploit the vulnerability to cause a...

Open Ticket Request System Information Disclosure Vulnerability (CNVD-2019-16544)

Open Ticket Request System OTRS is an open source defect tracking and management system software from the German OTRS Group. The software will be submitted by phone , e-mail and other channels of service requests into different queues , service levels , service personnel through the OTRS system t...

Open-source Ticket Request System Information Disclosure Vulnerability

Open-source Ticket Request System OTRS is an open-source defect tracking and management system software from the German OTRS Group. The software categorizes service requests submitted through various channels such as phone calls, emails, etc. into different queues and service levels, and the...

Zimbra Collaboration Server Cross-Site Scripting Vulnerability

Zimbra Collaboration Server ZCS is a suite of email and collaboration solutions from Zimbra, USA. The solution provides email, contacts, calendaring, file sharing, social networking, and more. A cross-site scripting vulnerability exists in the admin console in version 8.x of Zimbra ZCS prior to...