CVE-2020-11063

In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2...

CVE-2023-28952 IBM Cognos Controller log injection

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to injection attacks in application logging by not sanitizing user provided data. IBM X-Force ID: 251463...

IBM Cognos Controller 安全漏洞

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and creating and managing financial reports. A security vulnerability exists in IBM Cognos Controller versio...

[R2] Nessus Version 10.4.2 Fixes One Vulnerability

R2 Nessus Version 10.4.2 Fixes One Vulnerability Arnie Cabral Wed, 01/18/2023 - 10:22 A privilege escalation vulnerability was identified in Nessus versions 10.4.1 and earlier. An authenticated attacker could potentially execute a specially crafted file to obtain root or NT AUTHORITY / SYSTEM...

TYPO3 9.5.12 < 9.5.17 / 10.2 < 10.4.2 XSS (TYPO3-CORE-SA-2020-003)

The version of TYPO3 installed on the remote host is 9.5.12 prior to 9.5.17 or 10.2 prior to 10.4.2. It is, therefore, affected by a cross-site scripting XSS vulnerability in its link handling component due to improper validation of user-supplied input before returning it to users. An...

CVE-2020-11067

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings in $BEUSER-uc are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user...

CVE-2020-11063

In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2...