Cross site scripting

In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...

Fedora 30 : phpMyAdmin (2020-25f3aea389)

The phpMyAdmin team announces the release of both 4.9.5 and 5.0.2. Both versions contain several security fixes : - PMASA-2020-2 SQL injection vulnerability in the user accounts page, particularly when changing a password - PMASA-2020-3 SQL injection vulnerability relating to the search feature -...

CVE-2020-11441

phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable...

PT-2020-12610 · Phpmyadmin +2 · Phpmyadmin +2

Name of the Vulnerable Software and Affected Versions: phpMyAdmin version 5.0.2 Description: The issue allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. The vendor states that they do not see anything...

phpMyAdmin SQL Injection Vulnerability (CNVD-2020-21010)

phpMyAdmin is a free, web-based MySQL database management tool from the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A SQL injection vulnerability exists in phpMyAdmin version 4...

OpenEMR Path Traversal Vulnerability

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A path traversal vulnerability exists in the 'fileName' parameter of the...

Open redirect

dotCMS before 5.0.2 has open redirects via the html/common/forwardjs.jsp FORWARDURL parameter or the html/portlet/ext/common/pagepreviewpopup.jsp hostname parameter...

Intel Data Center Manager SDK Local Information Disclosure Vulnerability

Intel Data Center Manager SDK is a data center management SDK software development kit from Intel USA. The product provides real-time power and cooling data for devices. A security vulnerability exists in IntelR Data Center Manager SDK prior to version 5.0.2, which stems from the program failing ...

CVE-2019-0110

Insufficient key management for IntelR Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access...

Input validation

Improper file permissions for IntelR Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable disclosure of information via local access...

Input validation

Improper folder permissions in IntelR Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2019-0105

Insufficient file permissions checking in install routine for IntelR Data Center Manager SDK before version 5.0.2 may allow authenticated user to potentially enable escalation of privilege via local access...

Authorization

Insufficient file protection in uninstall routine for IntelR Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access...

Intel® Data Center Manager SDK Advisory

Summary: Multiple potential security vulnerabilities in Intel® Data Center Manager SDK may allow escalation of privilege, denial of service, or information disclosure. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2019-0102...

GHSA-29GP-92WP-94Q8 react-dev-utils on Windows vulnerable to Remote Code Execution

react-dev-utils on Windows is vulnerable to remote code execution. Recommendation Update to one of the following versions, depending on the release line that you are using. - 1.0.4 - 2.0.2 - 3.1.2 - 4.2.2 - 5.0.2 - 6.0.0-next.a671462c...

Fedora 29 : wordpress (2018-25b3204dc8)

See upstream announcements : - WordPress 5.0.2 Maintenance Release - WordPress 5.0.1 Security Release - WordPress 5.0 Bebo Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

Rapidly Evolving Ransomware Gandcrab Version

ARCHIVED STORY Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation By Alexandre Mundo · October 10, 2018 The GandCrab ransomware, which first appeared in January, has been updated rapidly during its short life, with Version 5.0.2 appearing this month. In this post we will...

CVE-2017-1312

IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

Security Bulletin: Cross-site Scripting vulnerability affects Rational Engineering Lifecycle Manager

Summary Rational Engineering Lifecycle Manager is vulnerable to a cross-site scripting attack with potential for credentials disclosure within a trusted session. Vulnerability Details CVEID: CVE-2017-1168 DESCRIPTION: IBM RELM is vulnerable to cross-site scripting. This vulnerability allows users...

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Reporting Service shipped with Rational Insight (CVE-2016-5898, CVE-2016-5899, CVE-2016-6054)

Summary Jazz Reporting Service is shipped as a component of Rational Insight. Information about multiple security vulnerabilities affecting Jazz Reporting Service has been published in a security bulletin. Vulnerability Details Consult the security bulletin Security Bulletin: Multiple security...