GHSA-5QCG-W2CC-XFFW Uncontrolled resource consumption in validators Python package

The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6...

Adobe Experience Manager Page Injection Vulnerability

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A user...

CVE-2019-16469

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to sensitive information disclosure...

UBUNTU-CVE-2020-5197

An issue was discovered in GitLab Community Edition CE and Enterprise Edition EE 5.1 through 12.6.1. It has Incorrect Access Control...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-02541)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress versions 3.7 through 5.3.0. The vulnerability stems...

UBUNTU-CVE-2019-20201

An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxmlparse functions mishandle XML entities, leading to an infinite loop in which memory allocations occur...

Mellow Fish YetiShare Information Disclosure Vulnerability (CNVD-2020-04700)

Mellow Fish YetiShare is a PHP-based file hosting web system script from Mellow Fish UK. An information disclosure vulnerability exists in Mellow Fish YetiShare versions 3.5.2 through 4.5.3, which stems from the program failing to set the Secure flag on session cookies, and can be exploited by an...

GitLab EE Access Control Error Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

Mellow Fish YetiShare Information Disclosure Vulnerability

Mellow Fish YetiShare is a PHP-based file hosting web system script from Mellow Fish UK. A security vulnerability exists in the accountforgotpassword.ajax.php file in Mellow Fish YetiShare versions 3.5.2 through 4.5.3. An attacker can exploit the vulnerability to enumerate user accounts by guessi...

CVE-2019-19733

getallfileserverpaths.ajax.php aka getallfileserverpaths.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS...

ezXML Code Problem Vulnerability

ezXML is an XML document parsing library . A code issue vulnerability exists in ezXML versions 0.8.2 through 0.8.6. The vulnerability arises from a design or implementation issue during code development of a networked system or product. An attacker could exploit the vulnerability to cause a NULL...

CVE-2019-6022

Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to alter arbitrary files via the 'Customapp' function...

Arbitrary File Upload Vulnerability in Contao

Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . A vulnerability exists in Contao versions 4.0 through 4.8.5. An attacker can exploit the vulnerability to upload arbitrary files and execute them o...

Cyxtera Technologies Unspecified Vulnerability in Cyxtera AppGate SDP Client

Cyxtera Technologies Cyxtera AppGate SDP is a software-defined network border protection solution from Cyxtera Technologies, U.S.A. Cyxtera AppGate SDP Client is one of the client programs. A security vulnerability exists in Cyxtera Technologies Cyxtera AppGate SDP Client versions 4.1.x through...

IBM WebSphere Application Server Liberty Cross-Site Scripting Vulnerability

IBM WebSphere Application Server Liberty is a U.S. IBM company built on the Open Liberty project on top of the Java application server . A cross-site scripting vulnerability exists in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 19.0.0.11. A remote attacker can exploit this...

GitLab Information Disclosure Vulnerability (CNVD-2020-20438)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise...

IBM Tivoli Netcool Impact Cross-Site Scripting Vulnerability

IBM Tivoli Netcool Impact is a suite of network management software from IBM in the United States. The software has the ability to automate business-critical functions and provide a platform that provides unified access to real-time data, events and indicators. A cross-site scripting vulnerabilit...

Unspecified Vulnerability in Unbound IPSec Module

Unbound is a DNS resolver that supports authentication recursion and caching.IPSec is one of the Internet Security Protocol modules. A security vulnerability exists in the IPSec module in Unbound versions 1.6.4 through 1.9.4, which can be exploited by an attacker to execute shell code with the he...

ALPINE-CVE-2019-18934

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with --enable-ipsecmod support, and ipsecmod is enabled and used in the configuration...

Exhibitor Command Injection Vulnerability

Exhibitor is the supervisor service used to manage ZooKeeper server instances. A command injection vulnerability in the Config editor in Exhibitor versions 1.0.9 through 1.7.1 can be exploited by an attacker to execute any command as the user running the Exhibitor process by inserting arbitrary...