CVE-2019-11855: Undefined Security Weakness

An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9...

CVE-2020-24585: Undefined Security Weakness

An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS applicationdata messages in epoch 0 do not produce an out-of-order error. Instead, these messages are returned to the application...

2020 CWE Top 25 Most Dangerous Software Weaknesses

The Homeland Security Systems Engineering and Development Institute, sponsored by the Department of Homeland Security and operated by MITRE, has released the 2020 Common Weakness Enumeration CWE Top 25 Most Dangerous Software Weaknesses list. The Top 25 uses data from the National Vulnerability...

GHSA-9XGP-HFW7-73RQ Authentication Weakness in keystone

There is an authentication weakness vulnerability in keystone before version 0.3.16. Due to a bug in the the default sign in functionality, incomplete email addresses could be matched. A correct password is still required to complete sign in...

PT-2020-21216

Name of the Vulnerable Software and Affected Versions keystone versions prior to 0.3.16 Description The issue is related to an authentication weakness. Due to a bug in the default sign in functionality, incomplete email addresses could be matched, but a correct password is still required to...

Roundcube Webmail Security Deficiency

The vulnerability of webmail for IMAP servers based on AJAX Roundcube is related to deficiencies in the security measures used to protect website structures. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

CVE-2020-8210

Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 discloses credentials of a service account...

PT-2020-6900 · Apache +2 · Apache Shiro +2

Name of the Vulnerable Software and Affected Versions: Apache Shiro versions prior to 1.6.0 Description: The issue is related to weaknesses in the authentication procedure of the Apache Shiro framework. It may allow a remote attacker to bypass existing security restrictions by sending a specially...

ETCD Authorization Issues Vulnerability

etcd is a key-value storage system for distributed systems written in the Go language. An authorization issue vulnerability exists in etcd versions prior to 3.4.10 and prior to 3.3.23. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a...

MySQL InnoDB Privilege Escalation

The vulnerability of the InnoDB component in the Oracle MySQL Server database management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain access to read, modify, add, or delete data using the MySQL protocol...

BI Publisher Security XSS

The vulnerability of the BI Publisher Security component of the Oracle BI Publisher reporting tool relates to the lack of security measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

PeopleSoft Enterprise FIN Expenses Unauthorized Access

The vulnerability of the Expenses component in the PeopleSoft Enterprise FIN Expenses business application is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information or to modify,...

Oracle VM VirtualBox Full Control

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization software is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

Analytics Web Answers component

The vulnerability of the Analytics Web Answers component of the Oracle Business Intelligence Enterprise Edition software is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data, or cause a service failure...

Cisco Data Center Network Manager Privilege Escalation

The vulnerability of the Web interface of the Cisco Data Center Network Manager DCNM system is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to increase their privileges through a specially crafted request...

WebRTC SCTP Fragment Check Data Compromise

The vulnerability of the SCTP fragment checking mechanism in WebRTC browsers such as Firefox, Firefox ESR, and the email client Thunderbird is related to the lack of a mechanism for checking the size of copied data. Exploiting this vulnerability can allow an attacker to gain access to confidentia...

CloudForms Management Engine Privilege Escalation

The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to increase their privileges...

CVE-2020-13294: Undefined Security Weakness

In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application...

CVE-2020-7817

MyBrowserPlus downloads the files needed to run the program through the setup file Setup.inf. At this time, there is a vulnerability in downloading arbitrary files due to insufficient integrity verification of the files...

CVE-2020-17353: Undefined Security Weakness

scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code...