CVE-2020-26936

Cloudera Data Engineering CDE before 1.1 was vulnerable to a CSRF attack...

GHSA-MJCR-RQJG-RHG3 Implementation trusts the "me" field returned by the authorization server without verifying it

Impact A malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final "me" URL value returned by the authorization server belongs to the same domain as the initial value entered by the user. Patches Version 1.1 fixes this...

Security Bulletin: IBM Spectrum Protect Plus allows use of TLS Version 1.1 protocols (CVE-2020-4783)

Summary IBM Spectrum Protect Plus should disable the use of TLS Version 1.1 protocols as this could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2020-4783 DESCRIPTION: IBM Spectrum Protect Plus could allow a remote attacker to obtain sensitive...

Code injection

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral...

File Upload Vulnerability in uublog v1.1

uublog is a lightweight PHP blog system developed in PHP MySQL. The source code uublogV1.1 is not tightly filtered and has file upload vulnerabilities. uublog v1.1 exists file upload vulnerability, attackers can exploit the vulnerability to upload malicious files and obtain server privileges...

CVE-2020-15536

An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields...

SQL injection vulnerability in us***.php of Easy B2C Mall System v1.1

Easy B2C mall system is a mall system based on open source framework development. Easy B2C Mall System V1.1 version us.php SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information in the database...

eten Technologies PSG-6528VM Cross-Site Scripting Vulnerability

The eten Technologies PSG-6528VM is a Gigabit PoE switch from eten Technologies of Taiwan, China. A cross-site scripting vulnerability exists in the eten Technologies PSG-6528VM version 1.1. The vulnerability stems from the lack of proper validation of client data by the WEB application. An...

Improper access control

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates ar...

IBM QRadar Advisor Information Disclosure Vulnerability

IBM QRadar Advisor is a suite of security threat analysis solutions from IBM USA. The product includes features such as security threat response and threat probing. An information disclosure vulnerability exists in IBM QRadar Advisor versions 1.1 through 2.5. An attacker can exploit this...

Patriot Viper RGB Buffer Overflow Vulnerability

The Patriot Viper RGB is a memory module device from Patriot Corporation of Taiwan, China. A buffer overflow vulnerability exists in Patriot Viper RGB version 1.1 and earlier. The vulnerability stems from a networked system or product performing operations on memory without properly validating da...

SQL Injection Vulnerability in Rookie Enterprise Website System PHP Version 1.1

Rookie enterprise website system can be used for free, can be used for commercial purposes, there is no time limit. The system is fully functional in the background, easy to operate, can be opened pseudo-static and pure static mode, conducive to SEO optimization; the front can be set to display...

Security Bulletin: A Security Vulnerability in Websphere Application Server Affects Predictive Customer Intelligence

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about security vulnerabilities affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: Remote...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2017-1743)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about security vulnerabilities affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin:...

Patriot Viper RGB Local Elevation of Privilege Vulnerability

The Patriot Viper RGB is a memory module device from Patriot Corporation of Taiwan, China. A local elevation of privilege vulnerability exists in the MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB versions prior to 1.1, which can be exploited by a local attacker to read or write to memory...

WordPress wps-hide-login plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wps-hide-login is a hide-login plugin used in it. A cross-site request forgery vulnerability exists in versions of the...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2019-4270)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin:...

CVE-2019-16321

ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATHINFO...

DEBIAN-CVE-2019-13045

Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server...

Bevywise Networks MQTTRoute Input Validation Error Vulnerability

Bevywise Networks MQTTRoute is an MQTT server for secure connectivity of IoT devices from Bevywise Networks, India. A security vulnerability exists in Bevywise Networks MQTTRoute version 1.1 build 1018-002. An attacker can exploit the vulnerability to cause a denial of service...