358 matches found
CVE-2020-12712
SOS JobScheduler JOE component (versions 1.12 and 1.13) stores FTP/SSH passwords using the profile name as the encryption key, enabling decryption of the plaintext password due to insecure encryption. Impact: attackers who can access the profile configuration can recover stored credentials. Root ...
sos-lekarna.cz Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1171841 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
sos-collector bug fix and enhancement update
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...
sos-collector bug fix and enhancement update
An update is available for sos-collector. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...
DEBIAN-CVE-2020-12284
cbsjpegsplitfragment in libavcodec/cbsjpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEGMARKERSOS handling because of a missing length check...
Information Disclosure
Sos is a set of tools that gather information about system hardware and configuration. The sos report utility incorrectly included Certificate-based Red Hat Network private entitlement keys in the resulting archive of debugging information. An attacker able to access the archive could use the key...
CVE-2020-6856
An XML External Entity XEE vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders...
CVE-2020-6855
A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a way that exhausts system resources and results in a denial of service...
Xxe
An XML External Entity XEE vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders...
CVE-2020-6855
A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a way that exhausts system resources and results in a denial of service...
CVE-2020-6855
CVE-2020-6855 affects SOS JobScheduler’s JOC Cockpit component (versions 1.11 and 1.13.2). The vulnerability is a large or infinite loop triggered by parameterizing housekeeping jobs, leading to resource exhaustion and denial of service. NVD reports a CVSSv3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI...
CVE-2020-6856
CVE-2020-6856 affects SOS JobScheduler’s JOC Cockpit (versions 1.12 and 1.13.2). The issue is an XML External Entity (XEE) vulnerability where an entity declaration in XML used to specify runtime settings for jobs/orders can cause an attacker to read server files. Connected sources consistently d...
CVE-2020-6856
An XML External Entity XEE vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders...
CVE-2020-6854
A cross-site scripting XSS vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HTML via JSON properties available from the REST API...
Cross site scripting
A cross-site scripting XSS vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HTML via JSON properties available from the REST API...
CVE-2020-6854
A cross-site scripting XSS vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HTML via JSON properties available from the REST API...
CVE-2020-6854
The provided connected documents confirm a cross-site scripting (XSS) vulnerability in the SOS JobScheduler JOC Cockpit component, affecting versions 1.11 and 1.13.2. The root cause is input handling that allows JSON properties from the REST API to be interpreted as executable client-side script ...
CVE-2014-3445
backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authentication by leveraging knowledge of the administrator password hash...
Authentication flaw
backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authentication by leveraging knowledge of the administrator password hash...
CVE-2014-3445
CVE-2014-3445 describes an authentication bypass in HandsomeWeb SOS Webpages prior to 1.1.12. The vulnerability resides in backup.php, which allows an unauthenticated user to perform administrative backups and potentially disclose the administrator password hash by manipulating the MD5-based key ...