Cybozu Garoon vulnerable to improper input validation

Overview Cybozu Garoon provided by Cybozu, Inc. contains an improper input validation vulnerability CWE-20. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning...

kernel: sync of excessive duration via an XFS v5 image with crafted metadata

A flaw was discovered in the XFS source in the Linux kernel. This flaw allows an attacker with the ability to mount an XFS filesystem, to trigger a denial of service while attempting to sync a file located on an XFS v5 image with crafted metadata...

XSS Vulnerability in CUPCMS v5.0 Frontend

CUPCMS v5.0 cup content management system integrates video, stars, news, comics, community and more. An XSS vulnerability exists in the frontend of CUPCMS v5.0, which can be exploited by attackers to obtain sensitive information from user cookies...

EyesOfNetwork eonweb Arbitrary OS Command Execution Vulnerability

EyesOfNetwork "EON" is the open source and free IT monitoring solution that combines practical ITIL processes with a technical interface that allows its workday program. eonweb is the web interface for EyesOfNetwork. An arbitrary operating system command execution vulnerability exists in...

CVE-2020-27533

A Cross Site Scripting XSS issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages...

Nagios XI Cross-Site Request Forgery Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. Nagios XI version 5.7.3 suffers from a cross-site request forgery vulnerability that can be exploited by...

CVE-2020-14783

Vulnerability in the Oracle Hospitality RES 3700 product of Oracle Food and Beverage Applications component: CAL. The supported version that is affected is 5.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hospitality RES 3700...

ALPINE-CVE-2020-14776

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

UBUNTU-CVE-2020-14760

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.7.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

PT-2020-4568 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition versions 5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Installation component of Oracle Business Intelligence Enterprise Edition,...

OLIMPOKS Cross-Site Scripting Vulnerability

OLIMPOKS is a mobile device application for vocational training from olimpoks Russia. The application offers provides the opportunity to conduct training in industrial safety certified areas approved by Rostekhnadzor, labor protection, labor protection, civil defense and emergency situations on...

Command Execution Vulnerability in Qiji Fortress v5.0 at Zhejiang Qiji Technology Co. Ltd (CNVD-2020-59415)

Qiji Technology is a product-based company founded by O&M management experts and focused on O&M operations. A command execution vulnerability exists in Zhejiang Qiji Technology Co. Qiji Fortress v5.0, which can be exploited by an attacker to gain server control privileges...

Command Execution Vulnerability in Qiji Fortress v5.0 at Zhejiang Qiji Technology Co. Ltd (CNVD-2020-59414)

Qiji Technology is a product-based company founded by O&M management experts and focused on O&M operations. A command execution vulnerability exists in Zhejiang Qiji Technology Co. Qiji Fortress v5.0, which can be exploited by an attacker to gain server control privileges...

PT-2020-5835 · Phpmyadmin +1 · Phpmyadmin +1

Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions 5.0.2 and earlier Description: The issue is related to a lack of neutralization of elements in a CSV file in the "Export" function of the phpMyAdmin web application for database management. This could allow a remote attack...

pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.

...

mysql: InnoDB unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

PT-2020-16210 · Typesetter · Typesetter Cms

Name of the Vulnerable Software and Affected Versions: Typesetter CMS versions 5.x through 5.1 Description: The issue allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. This behavior contradicts the security policy, and the vendor is fixing it for version...

Shijiazhuang City Zhenghong Network Technology Co., Ltd. Shop7z online shopping system v5.4 flagship version of the existence of file upload vulnerability

Shop7z online shopping system is a domestic ASP online store platform software. Shijiazhuang City Zhenghong Network Technology Co., Ltd. Shop7z online shopping system v5.4 flagship version of the existence of file upload vulnerability, an attacker can be exploited to obtain server control...

DEBIAN-CVE-2020-25412

comline in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy that may lead to arbitrary code execution...

mysql: Server: C API unspecified vulnerability (CPU Oct 2019)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: C API. Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL...