CVE-2020-8796

Biscom Secure File Transfer SFT before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server...

PT-2020-18329 · Oauth2 Proxy · Oauth2 Proxy

Name of the Vulnerable Software and Affected Versions: oauth2 proxy versions prior to 5.0 Description: An open redirect vulnerability has been found in oauth2 proxy. This issue could allow an attacker to silently harvest authentication tokens. For example, an attacker could use a URL like...

CVE-2013-5659

Wiz 5.0.3 has a user mode write access violation...

PYSEC-2020-85

An open redirect on the login form and possibly other places in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site...

PT-2020-19854 · Jfrog · Jfrog Artifactory

Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions 5.x through 6.x Description: The issue is caused by insecure FreeMarker template processing, which can lead to remote code execution. This can be achieved, for example, by modifying a .ssh/authorized keys file. The...

CVE-2020-2676

Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications component: Printing. The supported version that is affected is 5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5...

CVE-2019-19548

Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user...

Cryptographic Issues

Overview bcrypt is an A library to help you hash passwords. Affected versions of this package are vulnerable to Cryptographic Issues. When hashing a password containing an ASCII NUL character, that character acts as the string terminator. Any following characters are ignored. Remediation Upgrade...

UBUNTU-CVE-2020-1766

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...

PT-2020-15042 · Otrs +2 · Otrs Community Edition +2

Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions 5.0.0 through 5.0.39 OTRS Community Edition versions 6.0.0 through 6.0.24 OTRS Community Edition versions 7.0.0 through 7.0.13 Description: The issue allows for the spoofing of the 'from' fields in several...

Unspecified Vulnerability in Suricata (CNVD-2020-03839)

Suricata is a set of network intrusion detection system IDS, intrusion prevention system IPS and network security monitoring engine developed by the Open Information Security Foundation OISF and its supported vendors, which supports multi-threading, built-in IPv6, and the ability to load...

Suricata has an unspecified vulnerability

Suricata is a set of network intrusion detection system IDS, intrusion prevention system IPS and network security monitoring engine developed by the Open Information Security Foundation OISF and its supported vendors, which supports multi-threading, built-in IPv6, and the ability to load...

PT-2020-6917 · Suricata · Suricata

Name of the Vulnerable Software and Affected Versions: Suricata version 5.0.0 Description: An issue was discovered in Suricata that allows an attacker to bypass or evade any TCP-based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PU...

Typesetter Cross-Site Request Forgery Vulnerability (CNVD-2020-03269)

Typesetter is a content management system CMS. A cross-site request forgery vulnerability exists in the opt-out feature in Typesetter version 5.1. The vulnerability stems from a web application that does not adequately validate that a request is coming from a trusted user. An attacker could use...

CVE-2019-20154

An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. A cross-site scripting XSS vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitrary web script or HTML...

Determine Contract Lifecycle Management Cross-Site Scripting Vulnerability

Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. A cross-site scripting vulnerability exists in the getchart.jsp file in Determine CLM version 5.4, which stems from the lack of proper validation of client-side...

Determine Contract Lifecycle Management XML External Entity Injection Vulnerability

Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. An XML external entity injection vulnerability exists in the definitionuploadattach.jsp file in Determine CLM version 5.4, which can be exploited by an attacker...

ZOHO ManageEngine ADSelfService Plus Information Disclosure Vulnerability (CNVD-2020-04705)

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. An information disclosure vulnerability exists in ZOHO ManageEngine ADSelfService Plus version 5.6 Build 5607, which can be exploited by an attacker to retrieve internal information about the syst...

Apple iOS and Apple watchOS Mail Message Framework Component Resource Management Error Vulnerability

Apple iOS and Apple watchOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices. apple watchOS is an operating system for smartwatches. mail Message Framework is one of the email messaging frameworks. A resource management error vulnerability exists in th...

PHPOK system 5.4 file upload vulnerability in the background of Shenzhen Kunshuo Technology Co.

PHPOK system hereinafter referred to as OK system is a content management system for website construction developed by Shenzhen Kunshuo Technology Co., Ltd formerly known as PHPOK Studio, written in PHP, using MySQL database storage by default, and based on the LGPL open-source agreement licensed...