HPESBST04139 rev.1 - HPE Fibre Channel and SAN Switches with Brocade Fabric OS (FOS) Prior to v9.0.1a, Multiple Remote and Local Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Unauthorized Write Access to the File System; Remote: Authentication Bypass, Denial of Service DoS, Disclosure of Sensitive Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Brocade 32Gb Fibre Channel SAN Switch...

CVE-2021-1085

NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager vGPU plugin, where there is the potential to write to a shared memory location and manipulate the data after the data has been validated, which may lead to denial of service and escalation of privileges and information...

CVE-2020-29494: Improper Limitation of a Pathname to a Restricted Directory

Dell EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a Path Traversal Vulnerability in PDM. A remote user could potentially exploit this vulnerability, to gain unauthorized write access to the arbitrary files stored on the server filesystem, causing deletion of arbitrary files...

Teltonika TRB245 Improper Access Control Vulnerability

Teltonika TRB245 is a cellular network gateway product from Teltonika Lithuania. An improper access control vulnerability exists in firmware TRB2R00.02.04.01 of the Teltonika TRB245. The vulnerability stems from improper access control. An attacker could exploit the vulnerability to perform...

CVE-2020-5773

Improper Access Control in Teltonika firmware TRB2R00.02.04.01 allows a low privileged user to perform unauthorized write operations...

CVE-2020-5773: Improper Privilege Management

Improper Access Control in Teltonika firmware TRB2R00.02.04.01 allows a low privileged user to perform unauthorized write operations...

CVE-2020-2971

Vulnerability in the Oracle Application Express component of Oracle Database Server. Supported versions that are affected are 5.1-19.2. Easily exploitable vulnerability allows low privileged attacker having SQL Workshop privilege with network access via HTTP to compromise Oracle Application...

CVE-2020-7496

A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XDwhich could cause unauthorized write access when opening the project file...

CVE-2020-7495

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause unauthorized write access outside of expected pa...

Design/Logic Flaw

A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XDwhich could cause unauthorized write access when opening the project file...

CVE-2020-7495

Schneider Electric EcoStruxure Operator Terminal Expert (OTE) — CVE-2020-7495: A path traversal in ZIP file extraction affects OTE 3.1 Service Pack 1 and earlier (formerly Vijeo XD). The flaw allows writing outside the intended folder when opening a project file, enabling unauthorized writes. Evi...

CVE-2020-7495: Improper Limitation of a Pathname to a Restricted Directory

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause unauthorized write access outside of expected pa...

CVE-2020-7496: Improper Neutralization of Argument Delimiters in a Command

A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XDwhich could cause unauthorized write access when opening the project file...

CVE-2020-7501: Use of Hard-coded Credentials

A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic V1.1 HotFix 16 and prior and Vijeo Designer V6.2 SP9 and prior which could cause unauthorized read and write when downloading and uploading project or firmware into Vijeo Designer Basic and Vijeo Designer...

Oracle Java SE 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1 Multiple Vulnerabilities (Apr 2020 CPU) (Unix)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 261, 8 Update 251, 11 Update 7, or 14 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components : - Oracle Java SE and Java SE Embedded are...

CVE-2020-8599

Trend Micro Apex One 2019 and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability...

Realtek Chip ADSL Cat/Optical Cat Serial Port Command Execution Vulnerability in Realtek Semiconductor Co.

Realtek Corporation Realtek is a supplier of audio and networking chips. Realtek Semiconductor Corporation Realtek chip ADSL cat/optical cat serial port there is a command execution vulnerability, an attacker can use the vulnerability through the modem's arbitrary IPv4 address to access the...

Unspecified Vulnerability in SALTO ProAccess SPACE

Salto Systems ProAccess SPACE is a web-based access control management tool from Salto Systems, Spain. A security vulnerability exists in Salto Systems ProAccess SPACE version 5.4.3.0. An attacker can exploit the vulnerability to perform a write operation to an arbitrary path on the file system...

CVE-2019-11551: Improper Privilege Management

In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a file through the Code42 app to a location they do not have privileges to write...

Code Execution Vulnerability in PHP7CMS Frontend

PHP7 content management system referred to as PHP7CMS by Chunjie studio using PHP7 technology newly developed content management program. PHP7CMS code execution vulnerability exists in the foreground. Attackers can take advantage of the vulnerability without permission to invoke the function to...