The vulnerability of the web interface of Belden Hirschmann’s network switches of the RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS series allows a hacker to disclose protected information.

The vulnerability of the web interface of Belden Hirschmann’s network switches series RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS is related to errors in processing GET requests. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a GET...

Microsoft Exchange Server Spoofing Vulnerability

A cross-site-scripting XSS vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected server. The...

Microsoft Office SharePoint XSS Vulnerability

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

IBM Spectrum Protect Plus Command Injection Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14212)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14208)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

ruby: DoS by large request in WEBrick

It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory...

CVE-2020-0694

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0693...

Microsoft Office SharePoint XSS Vulnerability

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

PT-2020-1737 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: A cross-site scripting issue exists due to improper sanitization of specially crafted web requests...

The vulnerability of the sub-component of the Infrastructure component of the Oracle FLEXCUBE Universal Banking banking analytics system, a simulation modeling application of Oracle Financial Services, allows a perpetrator to gain access to read data or modify data.

The vulnerability of the Infrastructure sub-component of the Oracle FLEXCUBE Universal Banking component, a banking analytics system for simulation-based modeling by Oracle Financial Services Applications, is related to the lack of protection for operational data. Exploiting this vulnerability...

CVE-2019-19825

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an "topicurl":"setting/getSanvas" POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform...

Microsoft ASP.NET Core Denial of Service Vulnerability (CNVD-2020-16652)

Microsoft ASP.NET Core is a framework of cross-platform open source framework from Microsoft. The framework is used to build cloud-based applications such as Web applications, Internet of Things applications, and mobile backends. A denial of service vulnerability exists in Microsoft ASP.NET Core...

CVE-2020-7241

The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 20200..10..20..30..9 format, guessing UNIX...

CVE-2020-2560

Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM component: SWSE Server. Supported versions that are affected are 19.10 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attac...

CVE-2020-0656

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 On-Premise Cross Site Scripting Vulnerability'...

Denial of service

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'...

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics...

PT-2020-1295 · Microsoft +2 · Asp.Net Core +2

Name of the Vulnerable Software and Affected Versions: ASP.NET Core affected versions not specified Description: A denial of service issue exists due to improper handling of web requests by ASP.NET Core. This can be exploited by a remote attacker to cause a denial of service by sending specially...

nginx 0.8.x < 0.8.33 / 0.7.x < 0.7.65 Windows Filename Pseudonyms (CORE-2010-0121)

The installed version of nginx is 0.7.52 and prior to 0.7.65, or 0.8.x prior to 0.8.33. It is, therefore, affected by a flaw in Windows installations of nginx. This is due to nginx mishandling DOS-compatible 8.3 short filenames. An unauthenticated, remote attacker can exploit this, via web...