Server side request forgery (ssrf)

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external...

CVE-2020-26815: Server-Side Request Forgery (SSRF)

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external...

Directory traversal

ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter...

CVE-2020-12777

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information...

CVE-2020-12777

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information...

Improper access control

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information...

Default credentials

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64USERNAME:sha256PASSWORD. An unauthorized attacker inside the network can use the defaul...

CVE-2020-10275 RVD#2565: Weak token generation for the REST API.

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64USERNAME:sha256PASSWORD. An unauthorized attacker inside the network can use the defaul...

Microsoft Windows SMBv3 Remote Code Execution Vulnerability

Microsoft Windows is a series of operating systems released by the American company Microsoft. Microsoft Windows SMBv3 remote code execution vulnerability. An unauthorized remote attacker can perform remote code execution via a carefully constructed request packet...

Code injection

IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in further attacks against the system. IBM X-Force ID: 171438...

Linux KVM Information Disclosure Vulnerability

Linux KVM is a kernel-based virtual machine for Linux. An information disclosure vulnerability exists in Linux KVM. The vulnerability stems from errors such as configuration during operation of a networked system or product. An unauthorized attacker could exploit the vulnerability to obtain...

CVE-2020-2558

Vulnerability in the Oracle Solaris product of Oracle Systems component: Kernel. The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMB to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris,...

CVE-2020-2578

Vulnerability in the Oracle Solaris product of Oracle Systems component: Kernel. The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMB to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris,...

DOMPDF Information Disclosure Vulnerability

DOMPDF is a converter to convert HTML to PDF. An information disclosure vulnerability exists in versions of DOMPDF prior to 0.6.2. The vulnerability stems from a configuration or other error in the operation of a networked system or product. An unauthorized attacker could exploit the vulnerabilit...

WordPress WP SlackSync Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WP SlackSync is an online chat plugin used in it. An information disclosure vulnerability exists in WordPress WP...

Design/Logic Flaw

SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA instance, leading to Denial of Service...

CVE-2019-0350

SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA instance, leading to Denial of Service...

Authentication Bypass Vulnerability in Triconex SIS System

The Triconex SIS system is a modern programmable logic and process controller. An authentication bypass vulnerability exists in the Triconex SIS system, which could be exploited by an unauthorized attacker to gain access to the controller...

Google Android Information Disclosure Vulnerability (CNVD-2019-30366)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. System in Android Q suffers from an information disclosure vulnerability. The vulnerability stems from errors such as configuration during operation of a networked system or product. An...

PrinterOn Central Print Services Information Disclosure Vulnerability

PrinterOn Central Print Services CPS is a print service center management solution from PrinterOn Canada. An information disclosure vulnerability exists in PrinterOn CPS version 4.1.4 and earlier. The vulnerability stems from an error in configuration or other errors in the operation of a network...