haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes

A flaw was found in the way HAProxy processed certain HTTP/2 request packets. This flaw allows an attacker to send crafted HTTP/2 request packets, which cause memory corruption, leading to a crash or potential remote arbitrary code execution with the permissions of the user running HAProxy...

SUAP Cross-Site Scripting Vulnerability

SUAP is a unified public management system of the Brazilian IT Management Board DIGTI. The system supports functions such as personnel management, property control, warehouse management, extended project management and document agreement management. A cross-site scripting vulnerability exists in...

CVE-2019-7634

SUAP V2 allows XSS during the update of user information...

PT-2020-8876 · Re2C +3 · Re2C +3

Name of the Vulnerable Software and Affected Versions: re2c versions prior to 2.0 Description: The issue is related to uncontrolled recursion, which causes stack consumption in the find fixed tags function. This can lead to potential system instability. Recommendations: For versions prior to 2.0,...

Ruby JSON gem input validation error vulnerability

Ruby JSON gem is a Ruby-based package for parsing JSON from text and generating JSON text from Ruby objects. An input validation error vulnerability in Ruby JSON gem version 2.2.0 and earlier can be exploited to force the creation of arbitrary objects on a target system...

Rukovoditel Cross-Site Scripting Vulnerability (CNVD-2020-26655)

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . A cross-site scripting vulnerability exists in the User Access Groups page of the Application Structure...

PT-2020-6290 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.3.4 and earlier Magento versions 2.2.11 and earlier Magento version 1.14.4.4 and earlier Magento version 1.9.4.4 and earlier Description: The issue is related to a command injection vulnerability. It could allow a remote...

CVE-2020-11821

In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply brute force on them...

ALPINE-CVE-2020-11810

An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 PDATAV2 packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be...

PT-2020-10763 · Trustwave +1 · Opendmarc +1

Name of the Vulnerable Software and Affected Versions: OpenDMARC versions 1.3.2 and 1.4.x Description: The issue allows attacks to bypass SPF and DMARC authentication when the HELO field is inconsistent with the MAIL FROM field, specifically when OpenDMARC is used with pypolicyd-spf 2.0.2...

PT-2020-12481 · Percona · Percona Xtrabackup

Name of the Vulnerable Software and Affected Versions: Percona XtraBackup versions prior to 2.4.20 Description: The issue allows sensitive information to be unintentionally written to backup files and the PERCONA SCHEMA.xtrabackup history table when the --history option is used. This may include...

CVE-2017-18765

Certain NETGEAR devices are affected by denial of service. This affects R6300v2 before 1.0.4.8, R6400 before 1.0.1.22, R6400v2 before 1.0.2.32, R6700 before 1.0.1.20, R6900 before 1.0.1.20, WNR3500Lv2 before 1.2.0.44, and WNR2000v2 before 1.2.0.8...

Net new PHP enterprise website management system standard version (with mobile version) v2.6 exists arbitrary file deletion vulnerability

Netnew PHP enterprise website management system standard version with mobile version is developed using PHP + MYSQL technology and MVC mode, with clear architecture and easy-to-maintain code. Netnew PHP Enterprise Website Management System Standard Edition with Mobile Version v2.6 has an arbitrar...

Rukovoditel SQL Injection Vulnerability (CNVD-2020-26656)

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . A SQL injection vulnerability exists in Rukovoditel version 2.5.2. The vulnerability stems from a lack ...

Rukovoditel Code Issue Vulnerability

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . A security vulnerability exists in Rukovoditel version 2.5.2. An attacker can change the content-type...

CVE-2020-11820

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entitiesid parameter...

Unspecified Vulnerability in Oracle Java SE Advanced Management Console Component

Oracle Java SE is a U.S. Oracle Oracle company for the development and deployment of desktop, server and embedded devices and real-time environments in the Java application. A security vulnerability exists in the Advanced Management Console component of Oracle Java SE, version 2.16. An attacker...

Western Digital My Cloud Home and ibi Websites Clickjacking Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud Home and ibi Websites versions prior to 2.2.0. An attacker could exploit the vulnerability to hijack click-through actions on the login page...

CVE-2019-20664

Certain NETGEAR devices are affected by stored XSS. This affects RBR20 before 2.3.5.26, RBS20 before 2.3.5.26, RBK20 before 2.3.5.26, RBR40 before 2.3.5.30, RBS40 before 2.3.5.30, RBK40 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, and RBK50 before 2.3.5.30...

CVE-2020-10382

An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an authenticated remote code execution in the backup-scheduler...