PT-2020-12463 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 8.11 through 12.9 Description: The issue is related to information leakage on Issues opened in a public project and then moved to a private project. This leakage occurs through both the Web-UI and the GraphQL API...

IBM Security Information Queue Information Disclosure Vulnerability (CNVD-2020-22188)

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue ISIQ that stems from the program failin...

KLA11726 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Out of bounds write vulnerability in GMPDecodeData can be...

Security feature bypass

A security restriction bypass vulnerability has been discovered in Revive Adserver version 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was howev...

CVE-2020-4303

IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

PT-2020-05: Cross-site scripting (XSS) in F5 Traffic Management User Interface (TMUI)

The vulnerability allows remote attackers to execute malicious JavaScript code in the context of the current user. If the logged-on user has administrative rights and Advanced Shell bash access, an attacker who successfully exploited the vulnerability could fully compromise the BIG-IP system...

PT-2020-04: Arbitrary code execution in F5 Traffic Management User Interface (TMUI)

The vulnerability allows unauthorized remote attackers to execute malicious code on the system, obtain sensitive information, or hijack traffic, as well as use the server with the Traffic Management User Interface TMUI for attacks on other internal resources of the target organization. Advisory...

IBM Tivoli Netcool Impact Cross-Site Scripting Vulnerability (CNVD-2020-19258)

IBM Tivoli Netcool Impact is a suite of network management software from IBM in the United States. The software has the ability to automate business-critical functions and provide a platform that provides unified access to real-time data, events and indicators. A cross-site scripting vulnerabilit...

CVE-2019-4681

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...

IBM Jazz for Service Management Cross-Site Scripting Vulnerability (CNVD-2020-19257)

IBM Jazz for Service Management is an integrated service management product from IBM that provides visibility into the service management environment. A cross-site scripting vulnerability exists in IBM Jazz for Service Management version 1.1.3. A remote attacker can exploit this vulnerability to...

IBM Jazz for Service Management Cross-Site Scripting Vulnerability

IBM Jazz for Service Management is an integrated service management product from IBM that provides visibility into the service management environment. A cross-site scripting vulnerability exists in IBM Jazz for Service Management version 1.1.3. A remote attacker can exploit this vulnerability to...

Cisco SD-WAN Solution vManage Cross-Site Scripting Vulnerability

Cisco SD-WAN Solution is a set of network extension solutions from Cisco. vManage is a network management system. A cross-site scripting vulnerability exists in the Web UI in Cisco SD-WAN Solution vManage Releases prior to 19.2.2, which stems from the program failing to adequately validate...

IBM Tivoli Workload Scheduler Cross-Site Scripting Vulnerability

IBM Tivoli Workload Scheduler is a suite of enterprise task scheduling software from IBM in the United States. The software supports planning, executing and tracking jobs across multiple platforms and environments. A cross-site scripting vulnerability exists in IBM Tivoli Workload Scheduler versi...

CVE-2019-16010

A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the vManage software. The vulnerability is due to insufficient validation of...

PT-2020-2124 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage software affected versions not specified Description: The issue is related to a cross-site scripting XSS attack in the web UI of the Cisco SD-WAN vManage software. This is due to insufficient validation of user-supplied...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments

Summary Security vulnerabilities in WebSphere Application Server Liberty, such as spoofing, obtaining sensitive information, and bypassing security restrictions, affect IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrum Protect for Space Management, and IBM Spectrum Prote...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote, unauthenticated attacker to perform arbitrary actions using an authenticated user's session by persuading the victim to follow a malicious link...

FortiSIEM is vulnerable to a CSRF attack

A Cross-Site Request Forgery CSRF vulnerability in the user interface of FortiSIEM could allow a remote, unauthenticated attacker to perform arbitrary actions using an authenticated user's session by persuading the victim to follow a malicious link...

CVE-2019-17653: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote, unauthenticated attacker to perform arbitrary actions using an authenticated user's session by persuading the victim to follow a malicious link...

Debian DSA-4638-1 : chromium - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2019-19880 Richard Lorenz discovered an issue in the sqlite library. - CVE-2019-19923 Richard Lorenz discovered an out-of-bounds read issue in the sqlite library. - CVE-2019-19925 Richard Lorenz discovered an issue in...