CVE-2020-14887

Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications component: Infrastructure. Supported versions that are affected are 12.3.0 and 14.0.0-14.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

File Containment Vulnerability in MetInfo Enterprise Website Builder (CNVD-2020-58429)

MetInfo Enterprise Building System is a free and open source enterprise CMS. A file inclusion vulnerability exists in MetInfo version v5.0.4, which can be exploited by attackers to gain control of the server...

Exploit for CVE-2015-1538

PoC exploit for CVE-2015-1538-1, Google Stagefright ‘stsc’ MP4 Atom Integer Overflow Remote Code Execution. The target product/service is Google Stagefright, a media library for Android. The vulnerability class/vector is Integer Overflow in the libstagefright MP4 'stsc' atom handling, leading to...

CVE-2020-17465

Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4, 6.0.0.6...

Squid Denial of Service Vulnerability (CNVD-2020-48582)

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in Squid versions prior to 4.13 and 5.0.4 in the 5.x series, which can be exploited by...

Vulnerabilities fixed in Squid

Squid's developers have fixed three vulnerabilities. Of one vulnerability no CVE-id is known. The vulnerabilities allow a remote malicious party the ability to use cache poisoning to potentially gain access to sensitive data, or to cause a Denial-of-Service. The developers have released updates t...

grub2: Fail kernel validation without shim protocol

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim...

grub2: Use-after-free redefining a function whilst the same function is already executing

GRUB2 contains a race condition in grubscriptfunctioncreate leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2...

grub2: Use-after-free redefining a function whilst the same function is already executing

GRUB2 contains a race condition in grubscriptfunctioncreate leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2...

grub2: Fail kernel validation without shim protocol

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim...

DEBIAN-CVE-2020-15706

GRUB2 contains a race condition in grubscriptfunctioncreate leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2...

UBUNTU-CVE-2020-15706

GRUB2 contains a race condition in grubscriptfunctioncreate leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2...

PT-2020-6737 · Grub2 +7 · Grub2 +7

Name of the Vulnerable Software and Affected Versions: GRUB2 versions 2.04 and prior Description: The issue is related to an incorrect validation of cryptographic signatures in the GRUB2 bootloader, which can allow an attacker to bypass secure boot and execute arbitrary code, gaining full control...

IBM MQ Elevation of Privilege Vulnerability (CNVD-2020-35725)

IBM MQ IBM WebSphere MQ is a messaging middleware product from IBM. The product is mainly for the service-oriented architecture SOA to provide a reliable and proven messaging backbone. A security vulnerability exists in IBM MQ used on HPE NonStop versions 8.1.0 and 8.0.4. An attacker could exploi...

IBM Spectrum Scale Encryption Problem Vulnerability (CNVD-2020-30835)

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

Ruby on Rails Cross-Site Request Forgery Vulnerability (CNVD-2020-32423)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A cross-site request forgery vulnerability exists in Ruby on Rails versions prior to 5.2.5 and 6.0.4, which stems from a WEB application that does not adequately validate that a request is comin...

DEBIAN-CVE-2013-4090

Varnish HTTP cache before 3.0.4: ACL bug...

The vulnerability in the PHP interpreter’s error page 404 allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability in the PHP interpreter’s error page 404 exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JAXP. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

DEBIAN-CVE-2019-2977

Vulnerability in the Java SE product of Oracle Java SE component: Hotspot. Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of th...