CVE-2020-23450

Spiceworks Version = 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/inventory/groups/ without output sanitization...

CVE-2020-5540

Cross-site scripting vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to inject arbitrary script or HTML via a specially crafted URL...

Enterprise Search 7.9.0 security update

Enterprise Search credential exposure flaw ESA-2020-11 Elastic Enterprise Search versions before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the ‘developer’ role, they will be able to view the administrator API credentials. These credentials could allo...

IBM Maximo Asset Management Path Traversal Vulnerability (CNVD-2020-46262)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A path traversa...

IBM WebSphere Application Server Remote Code Execution Vulnerability

IBM WebSphere Application Server WAS is an application server product from IBM in the United States. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A remote code execution vulnerability exists in IBM WAS versions 7....

Multiple vulnerabilities in CyberMail

Overview CyberMail contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2020-5540 Open Redirect CWE-601 - CVE-2020-5541 Tony Kuo and Chia-Lung Hsieh of CHT Security reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

PT-2020-15053 · Otrs +1 · Otrs Community Edition +2

Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions 6.0.28 and prior OTRS versions 7.0.18 and prior OTRS versions 8.0.4 and prior Description: The issue occurs when an agent user is renamed or set to invalid, and the session belonging to the user remains active...

IBM QRadar SIEM XML Entity Injection Vulnerability

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A security...

CVE-2020-4512

IBM QRadar SIEM 7.3 and 7.4 could allow a remote privileged user to execute commands...

SAP Solution Manager Injection Vulnerability

SAP Solution Manager is a set of system monitoring, SAP support desktop, self-service, ASAP implementation and other functions of the German SAP company as one of the system management platform. The platform can help customers establish SAP solution lifecycle management, and provide system...

Cellebrite UFED Trust Management Issues Vulnerability (CNVD-2020-51755)

Cellebrite UFED is a universal forensic product from Cellebrite Israel. The product is mainly used for data extraction, transmission and analysis of devices. A security vulnerability exists in Cellebrite UFED versions 5.0 through 7.5.0.845. An attacker could exploit the vulnerability to access...

CVE-2020-8542

OX App Suite through 7.10.3 allows XSS...

CVE-2020-8544

OX App Suite through 7.10.3 allows SSRF...

OpenStack Mistral Denial of Service Vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration and Rackspace, Inc. in the U.S. Mistral is one of the workflow services. A denial of service vulnerability exists in OpenStack Mistral 7.0.3 and earlier versions that can be exploited b...

CVE-2020-6260

SAP Solution Manager Trace Analysis, version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional data that do not actually exist...

Micro Focus ArcSight Logger Cross-Site Scripting Vulnerability (CNVD-2020-36749)

Micro Focus ArcSight Logger is a suite of log management software from Micro Focus UK. The software collects and integrates data from any log generation source for log management, searching, indexing, reporting, analysis and retention. A cross-site scripting vulnerability exists in Micro Focus...

UBUNTU-CVE-2020-7014

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

PT-2020-2735 · Panasonic · Video Insight Vms

Name of the Vulnerable Software and Affected Versions: Video Insight VMS versions prior to 7.6.1 Description: The issue is caused by insufficient validation of user-provided data, allowing a remote attacker to execute arbitrary code by sending a specially crafted malicious request. This can lead ...

Panasonic Video Insight VMS vulnerable to arbitrary code execution

Overview Video Insight VMS provided by Panasonic Corporation contains an arbitrary code execution vulnerability CWE-94. Panasonic Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Panasonic Corporation coordinated under the Information...

SAP Business Client Code Issue Vulnerability

SAP Business Client is a user interface client program from SAP Germany. The program supports access to multiple SAP applications from a single platform. A code issue vulnerability exists in SAP Business Client version 7.0, which arises from an uncontrolled search path element in the program. The...