jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Unspecified Vulnerability in Avast Antivirus

Avast Antivirus is a suite of antivirus software from the Czech company Avast. A security vulnerability exists in the aswTask RPC endpoint of the TaskEx library in previous versions of Avast Antivirus 20. The vulnerability can be exploited by an attacker to bypass security restrictions with the...

IBM Content Navigator Information Disclosure Vulnerability (CNVD-2020-19221)

IBM Content Navigator is a Web client from IBM USA. The product supports searching and processing documents stored in content servers from a Web browser. A security vulnerability exists in IBM Content Navigator version 3.0CD. An attacker can exploit the vulnerability to obtain sensitive informati...

uppy npm package server-side request forgery vulnerability

uppy npm package is a file upload package. A server-side request forgery vulnerability exists in versions of uppy npm package prior to 1.9.3, which can be exploited by an attacker to scan local or external networks or interact with internal systems...

D-Link DSL-2875AL Information Disclosure Vulnerability (CNVD-2020-18994)

The D-Link DSL-2875AL is a wireless router from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DSL-2875AL prior to version 1.00.05. The vulnerability can be exploited by an attacker to obtain a password by sending a simple /romfile.cfg request to the web management...

CVE-2020-2090

A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method...

Oracle Application Testing Suite CVE-2020-2673 Remote Security Vulnerability

Description Oracle Application Testing Suite is prone to a remote security vulnerability. The vulnerability can be exploited over the 'HTTP' protocol. The 'Oracle Flow Builder' component is affected. This vulnerability affects the following supported versions: 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0...

Unspecified Vulnerability in Unbound IPSec Module

Unbound is a DNS resolver that supports authentication recursion and caching.IPSec is one of the Internet Security Protocol modules. A security vulnerability exists in the IPSec module in Unbound versions 1.6.4 through 1.9.4, which can be exploited by an attacker to execute shell code with the he...

PHP Scripts Mall API Based Travel Booking Cross Site Scripting Vulnerability

PHP Scripts Mall API Based Travel Booking is an online travel booking system script by PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall API Based Travel Booking version 3.4.7, which can be exploited by an attacker to execute client-side code...

HPE Intelligent Management Center (IMC) Expression Language Injection Remote Code Execution Vulnerability (CNVD-2019-23744)

HPE Intelligent Management Center IMC is a comprehensive management platform built from the ground up to support the Failure, Configuration, Accounting, Performance and Security FCAPS model. A GWT deviceservice queryCustomCondition expression language injection remote code execution vulnerability...

CVE-2019-11952

A remote code execution vulnerability was identified in HPE Intelligent Management Center IMC PLAT earlier than version 7.3 E0506P09...

PT-2019-18324 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 9.4.1.16828 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The...

PT-2019-2860

Name of the Vulnerable Software and Affected Versions node-tar versions prior to 4.4.2 node-tar version 2.2.2 is not affected, but versions prior to 2.2.2 are affected Description The issue is related to incorrect link resolution before file access in the node-tar module of the Node.js library...

Grandstream GWN7000 and Grandstream GWN7610 Information Disclosure Vulnerabilities

The Grandstream GWN7610 and Grandstream GWN7000 are both products of Grandstream, a wireless access point device.The Grandstream GWN7000 is an enterprise-class VPN router. An information disclosure vulnerability exists in the Grandstream GWN7000 prior to version 1.0.6.32 and the GWN7610 prior to...

CVE-2019-3850

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly in the same window. Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more...

WordPress social-warfare plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. social-warfare plugin is a social platform sharing plugin used in it. A cross-site scripting vulnerability exists in WordPress...

DEBIAN-CVE-2019-7329

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the form action on multiple views utilizes $SERVER'PHPSELF' insecurely, mishandling any arbitrary input appended to the webroot URL, without any proper filtration, leading to XSS...

Debian DLA-1640-1 : tmpreaper security update

It was discovered that tmpreaper, a program that cleans up files in directories based on their age, is vulnerable to a race condition. This vulnerability might be exploited by local attackers to perform privilege escalation. For Debian 8 'Jessie', this problem has been fixed in version...

exist-db:exist-core XML External Entity (XXE) vulnerability

exist version = 5.0.0-RC4 contains a XML External Entity XXE vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning...

Apereo Bedework bw-webdav XML External Entity Injection Vulnerability

Apereo Bedework bw-webdav is a general purpose webdav server. It is primarily used to interact with the backend to access resources. A security vulnerability exists in Apereo Bedework bw-webdav versions prior to 4.0.3. An attacker can exploit this vulnerability to perform an XML external entity...