CVE-2021-2275

CVE-2021-2275 corresponds to a vulnerability in Oracle Applications Manager (View Reports) within Oracle E-Business Suite. Affected are 12.1.3 and 12.2.3–12.2.10. The issue allows a highly privileged attacker with network access via HTTP to compromise Oracle Applications Manager, enabling unautho...

HTML Injection

firefox is vulnerable to HTML injection. Lack of escaping allows an attacker to inject and execute arbitrary HTML in a user's browser when a webpage was viewed in Reader View. While a secure Content Security Policy prevents direct code execution, HTML injection is still possible...

CVE-2021-2175

Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any View, Select Any View privilege with network access via Oracle Net ...

Oracle Applications Manager 安全漏洞

Oracle Applications Manager is an application management software from Oracle USA. The software provides monitoring, trending, and fault management for Oracle data files. A security vulnerability exists in Oracle Applications Manager View Reports 12.1.3, 12.2.3-12.2.10, which allows a highly...

PT-2021-2874 · Oracle · Oracle Database Server +1

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, and 19c Description: The issue is related to the Database Vault component, where an easily exploitable vulnerability allows a high-privileged attacker with Create Any View, Select Any...

GHSA-RP4X-WXQV-CF9M Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL. -...

Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL. -...

GHSA-JQJ4-R483-4GVR Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL. -...

Mozilla Firefox < 88.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 88.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-16 advisory. - Mozilla developers and community members Ryan VanderMeulen, Sean Feng, Tyson Smith, Julian Seward, Christian...

[SECURITY] Fedora 32 Update: libpano13-2.9.20-1.fc32

Helmut Dersch's Panorama Tools library. Provides very high quality manipulation, correction and stitching of panoramic photographs. Due to patent restrictions, this library has a maximum fisheye field-of-view restriction of 179 degrees to prevent stitching of hemispherical photograph s...

[SECURITY] Fedora 33 Update: libpano13-2.9.20-1.fc33

Helmut Dersch's Panorama Tools library. Provides very high quality manipulation, correction and stitching of panoramic photographs. Due to patent restrictions, this library has a maximum fisheye field-of-view restriction of 179 degrees to prevent stitching of hemispherical photograph s...

Privilege Escalation

Jenkins is vulnerable to privilege escalation. The vulnerability exists due to improper checks on newly created view allowing attackers with View/Create permission to create views with invalid or already-used names...

FreeBSD : jenkins -- multiple vulnerabilities (9595d002-edeb-4602-be2d-791cd654247e)

Jenkins Security Advisory : DescriptionLow SECURITY-1721 / CVE-2021-21639 Lack of type validation in agent related REST API Medium SECURITY-1871 / CVE-2021-21640 View name validation bypass C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Matteo Piovanelli Orchard 代码问题漏洞

Matteo Piovanelli Orchard is a Matteo Piovanelli open source application. A free, open source, community-centered content management system built on the ASP.NET MVC platform. A security vulnerability exists in Orchard versions prior to 1.10, which stems from a vulnerability that allows an attacke...

Vulnerability fixed in Tableau Server

A vulnerability has been fixed in Tableau Server. The vulnerability allows a malicious person to use an Open Redirect attack to send the visitor with a custom link to a malicious website redirect when sharing a "view." Salesforce has released updates to fix the vulnerability fix in Tableau Server...

CloudBees Jenkins View Name Validation Bypass Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

Jenkins LTS < 2.277.2 / Jenkins weekly < 2.287 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.277.2 or Jenkins weekly prior to 2.287. It is, therefore, affected by multiple vulnerabilities: - Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not valida...

CVE-2021-21640

A flaw was found in Jenkins. Due to lack of validation of the newly created view name, an attackers with View/Create permission are allowed to create views with invalid or already-used names...

CVE-2021-21640

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names...

CVE-2021-21640

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names...