Unspecified vulnerability in Magento (CNVD-2020-52448)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions. A security vulnerability exists in Magento Open Source versions prior to 1.9.4.2 and Magento Commerce versions prio...

CVE-2018-14867

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters...

Improper access control

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters...

CVE-2018-14867

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters...

Magento Code Execution Vulnerability (CNVD-2019-39393)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento version 2.1 before 2.1.18, version 2.2 before 2.2.9 and version 2.3...

ImageMagick Using Uninitialized Values Vulnerability

ImageMagick Studio ImageMagick is the United States ImageMagick Studio company's set of open source image processing software. A use of uninitialized values vulnerability exists in the SyncImageSettings function in MagickCore/image.c in ImageMagick 7.0.8-34. No detailed vulnerability details are...

ImageMagick Uses Uninitialized Values Vulnerability (CNVD-2019-29236)

ImageMagick Studio ImageMagick is the United States ImageMagick Studio company's set of open source image processing software. A use of uninitialized values vulnerability exists in the ReadPANGOImage function in coders/pango.c in ImageMagick 7.0.8-34. No details of the vulnerability are provided ...

ImageMagick Uses Uninitialized Values Vulnerability (CNVD-2019-29237)

ImageMagick Studio ImageMagick is the United States ImageMagick Studio company's set of open source image processing software. A use of uninitialized values vulnerability exists in the WriteJP2Image function in coders/jp2.c in ImageMagick 7.0.8-34. No details of the vulnerability are provided at...

CVE-2019-12961

LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function...

PRODSECBUG-2174: Use of insufficiently random values in multiple security relevant contexts

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...

PRODSECBUG-2267: Use of insufficiently random values when generating initialization vector

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...

Denial Of Service (DoS)

keycloak-connect is vulnerable to denial of service. Failure to validate JWT signatures on /klogout route allows remote attackers to force logout users and indefinitely deny service to the application using malicious JWTs with NBF values...

CVE-2019-4364

IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commands on the system. IBM X-Force ID: 161680...

GHSA-68HW-VFH7-XVG8 Forced Logout in keycloak-connect

Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to version 4.4...

PT-2019-12932 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.7 Description: An issue was discovered in the CSV export of com actionslogs, which is vulnerable to CSV injection. Recommendations: For versions prior to 3.9.7, update to version 3.9.7 or later to resolve the iss...

CVE-2019-9084

In Hoteldruid before 2.3.1, a division by zero was discovered in $numtabelle in tabtariffe.php aka the numtariffa1 parameter due to the mishandling of non-numeric values, as demonstrated by the /tabtariffe.php?anno=YEAR&numtariffa1=1a URI. It could allow an administrator to conduct remote denial ...

Malicious Package

Overview Version 1.0.8 of ember-power-timepicker contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your...

CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

Design/Logic Flaw

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

CVE-2018-6185

CVE-2018-6185 concerns Cloudera Navigator Key Trustee KMS (versions 5.12 and 5.13). The root cause is an incorrect default ACL configuration for the two additional APIs (PURGE and UNDELETE) that govern encryption-zone keys; the ACLs default to “*”, permitting remote access to these commands. This...