Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
35 results · Clear filters · Feed
-
Low 1.6
Privilege escalation in Bitdefender AV for Mac
A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests submitted to the Bitdefender Cloud. This issue affects: Bitdefender Bitdefender Antivirus for Mac v…
-
Low 3.1
Jenkins REST APIs vulnerable to clickjacking
REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.
-
Low 3.7
IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This coul…
-
Low 2.7
IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error mess…
-
Low 2.7
IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporope…
-
Low 3.1
IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive COR…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0. A reflected XSS attack could be performed in the inline API document…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has b…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has b…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and …
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and …
-
Low 3.7
Insecure handling of repodata and packages in SUSE Studio onlite
A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these connections. This issue affects: SUSE Stu…
-
Low 3.7
Link injection in SimpleSAMLphp
### Background Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging…
-
Low 2.9
yast: Fallback to DES without configuration in /etc/login.def
yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until…
-
Low 3.9
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2,…
-
Low 3.1
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions th…
-
Low 3.3
Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Application…
-
Low 3.7
Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions…
-
Low 3.3
Vulnerability in the Oracle VM Server for SPARC product of Oracle Systems (component: Templates). The supported version…
-
Low 3.9
Vulnerability in the Oracle Applications DBA component of Oracle Database Server. Supported versions that are affected …
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plugin). Supported versions that ar…
-
Low 3.9
Vulnerability in the Oracle Applications DBA component of Oracle Database Server. Supported versions that are affected …
-
Low 2.4
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2,…
-
Low 3.3
Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affecte…
-
Low 3.1
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI…
-
Low 3.1
CSRF vulnerability in Jenkins Amazon EC2 Plugin
A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.
-
Low 2.7
Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6…
-
Low 3.5
Possible to send drafted messages as wrong agent
Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: …
-
Low 2.0
Improper handling of uploaded inline images
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edi…
-
Low 3.5
Spoofing of From field in several screens
An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and …
-
Low 3.7
A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a deni…
-
Low 3.5
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through …