Vtiger CRM 跨站脚本漏洞

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. Vtiger CRM v7.2.0 suffers from a cross-site scripting vulnerability th...

PT-2021-11668 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server and Data Center versions prior to 7.2.0 Description: The issue allows remote attackers to impact the application's availability via a Denial of Service DoS vulnerability in the avatar upload feature. Recommendation...

Atlassian Confluence Server Code Issue Vulnerability

Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi. A security vulnerability exists in Atlassian Confluence Server versions prior to 7.2.0 that could...

PT-2021-11266 · Skyworth · Skyworth Gn542Vf

Name of the Vulnerable Software and Affected Versions: SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 SKYWORTH GN542VF Boa version 0.94.13 Description: The issue is related to the session cookie in an HTTPS session not having the Secure flag set, making it easier for remote...

flatCore CMS build cross-site scripting vulnerability

flatCore is a lightweight content management system CMS based on PHP and SQLite. A cross-site scripting vulnerability exists in flatCore CMS prior to version 2.0.0 build 139, which stems from the program accepting malicious client-side scripts without proper detection and can be exploited by an...

IBM Security Guardium Insights 信息泄露漏洞

IBM Security Guardium Insights is a modern hybrid cloud data security hub designed to provide a reliable view of an organization's data security and compliance posture. An information disclosure vulnerability exists in IBM Security Guardium Insights 2.0.2. A remote attacker could exploit this...

Linbit csync2 Input Validation Error Vulnerability

Linbit csync2 is a cluster synchronization tool from Austrian company Linbit, which is mainly used to keep files on multiple hosts in a cluster synchronized. A security vulnerability exists in LINBIT csync2 version 2.0 and earlier versions, which stems from a failure to properly check the return...

CVE-2020-28185

User Enumeration vulnerability in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php...

Terramaster TOS Permission License and Access Control Issues Vulnerability

Terramaster TOS is a Linux-based operating system dedicated to the erraMaster Cloud Storage NAS server from Shenzhen Tumi Electronic Technology Terramaster in China. A security vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which can be exploited by a remote,...

Terramaster TOS Path Traversal Vulnerability

Terramaster TOS is a Linux-based operating system dedicated to the erraMaster Cloud Storage NAS server from Shenzhen Tumi Electronic Technology Terramaster in China. A path traversal vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which allows a remote authenticated...

CVE-2020-4747

IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated CLI session due to improper authentication methods. IBM X-Force ID: 188516...

TIBCO Partnerexpress Authorization Issues Vulnerability

TIBCO Partnerexpress is a Php-based barcode generator by product name platform from Egavilan Media TIBCO, USA. A security vulnerability exists in TIBCO PartnerExpress 6.2.0, which stems from the REST API component containing a vulnerability that could theoretically be exploited by an...

UBUNTU-CVE-2020-27821

A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting i...

PT-2020-18894 · Google +1 · Libprotobuf +1

Name of the Vulnerable Software and Affected Versions: Valve's Game Networking Sockets versions prior to v1.2.0 Description: The issue arises from improper handling of inlined statistics messages in the CConnectionTransportUDPBase::Received Data function, leading to an exception thrown from...

CVE-2020-26221

touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting XSS. The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser...

CVE-2020-26219

touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection...

freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read

In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdpreadfontcapabilityset could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0...

freerdp: Integer overflow in VIDEO channel

In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the serve...

PT-2020-15543 · Jenkins · Jenkins Azure Key Vault Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Azure Key Vault Plugin versions 2.0 and earlier Description: A missing permission check in the Jenkins Azure Key Vault Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

freerdp: Out of bound read in cliprdr_server_receive_capabilities

In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0...