4344 matches found
Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2020-44273)
Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, etc. Advanced Outbound Telephony is one of the tools used for outbound ca...
Unspecified Vulnerability in Oracle Primavera Portfolio Management (CNVD-2020-52050)
Primavera Portfolio Management is a software solution for advising, planning, controlling and strategically analyzing your portfolio. A security vulnerability exists in the Web Server component in Primavera Portfolio Management 16.1.0.0-16.1.5.1, 18.0.0.0-18.0.2.0, 19.0.0.0. An attacker could...
CVE-2020-7584
A vulnerability has been identified in SIMATIC S7-200 SMART CPU family All versions = V2.2 V2.5.1. Affected devices do not properly handle large numbers of new incomming connections and could crash under certain circumstances. An attacker may leverage this to cause a Denial-of-Service situation...
CVE-2020-14171
Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle MITM attack...
CVE-2020-8176
A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...
rubygems: Escape sequence injection vulnerability in gem owner
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur...
PuTTY Information Disclosure Vulnerability
PuTTY is a suite of free Telnet, Rlogin and SSH client software from Simon Tatham Software Developers. The software is primarily used for remote administration of Linux systems. A security vulnerability exists in PuTTY versions 0.68 through 0.73. An attacker could exploit the vulnerability to...
CVE-2020-7492
A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the password when the user is entering the password because it is not masqueraded...
PT-2020-6510 · Mobileiron · Mobileiron Sentry +3
Name of the Vulnerable Software and Affected Versions: MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 MobileIron Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0...
F5 NGINX Controller Authorization Issue Vulnerability (CNVD-2020-51553)
F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. An authorization issue vulnerability exists in F5 NGINX Controller versions 3.0.0 through 3.4.0 in NGINX Controller...
thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol
In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data...
CVE-2020-6246
SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXTTABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability...
freerdp: Out-of-bounds write in planar.c
A flaw was found in freerdp in versions between 1.0 and 2.0.0. An out-of-bounds memory write was found in the planar.c function which could allow an attacker to control data sent from the RDP server to the client. The highest threat from this vulnerability is to data confidentiality and integrity...
freerdp: Integer overflow in region.c
A flaw was found in FreeRDP in versions between 1.0 and 2.0.0. An integer overflow was found in the region.c function which could allow an attacker the ability to control the RDP server as well as the data sent to the client. The highest threat from this vulnerability is to data confidentiality a...
AEgir Information Disclosure Vulnerability (CNVD-2020-31168)
AEgir is a JavaScript project automation build package from Protocol Labs. An information disclosure vulnerability exists in aegir publish and aegir build in Aegir versions 21.7.0 through 21.10.1 excluding version 21.10.1. An attacker can use this vulnerability to obtain information about...
CVE-2020-4358
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 17876...
thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol
In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data...
NaviServer Denial of Service Vulnerability
NaviServer is a high-performance Web server written in C and Tcl. A denial of service vulnerability exists in NaviServer versions 4.99.4 through 4.99.19. The vulnerability stems from the nsd/driver.c ChunkedDecode function failing to properly validate the length of a chunk. A remote attacker coul...