Archive
January 2020
Vulnerabilities first published in this month (UTC), newest first.
308 results · Clear filters · Feed
-
Medium 5.3
Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: UIF Open UI). Supported versions that…
-
Medium 5.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affect…
-
Medium 4.7
Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: SWSE Server). Supported versions that…
-
Medium 4.3
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…
-
Medium 4.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). The s…
-
Medium 4.7
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Security). Supported …
-
Medium 6.1
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authenticati…
-
Medium 6.1
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). Supported versio…
-
Medium 4.7
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: An…
-
Medium 5.9
Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affecte…
-
Medium 4.1
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2,…
-
Medium 5.0
Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affecte…
-
Medium 6.1
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported…
-
Medium 4.3
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…
-
Medium 6.5
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
Medium 5.4
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). …
-
Medium 6.1
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authenticati…
-
Medium 6.1
Reflected XSS vulnerability in Jenkins gitlab-hook Plugin
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
-
Medium 4.3
Redgate SQL Change Automation Plugin stored credentials in plain text
Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 5.0
Missing permission checks in Health Advisor by CloudBees Plugin
A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient.
-
Medium 5.0
CSRF vulnerability in Health Advisor by CloudBees Plugin
A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content to an attacker-specified recipient.
-
Medium 6.5CVE-2020-1611 Public exploit
Junos Space: Malicious HTTP packets sent to Junos Space allow an attacker to view all files on the device.
A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1.
-
Medium 5.4
Junos OS: Path traversal vulnerability in J-Web
A path traversal vulnerability in the Juniper Networks Junos OS device may allow an authenticated J-web user to read files with 'world' readable permission and delete files with 'world' writeable permission. This issue does not affect system files that can be…
-
Medium 6.5
Junos OS: EX4300/EX4600/QFX3500/QFX5100 Series: Stateless IP firewall filter may fail to evaluate certain packets
On EX4300, EX4600, QFX3500, and QFX5100 Series, a vulnerability in the IP firewall filter component may cause the firewall filter evaluation of certain packets to fail. This issue only affects firewall filter evaluation of certain packets destined to the devi…
-
Medium 5.3
Junos OS: Upon receipt of certain types of malformed PCEP packets the pccd process may crash.
Certain types of malformed Path Computation Element Protocol (PCEP) packets when received and processed by a Juniper Networks Junos OS device serving as a Path Computation Client (PCC) in a PCEP environment using Juniper's path computational element protocol …
-
Medium 6.5
Junos OS: A specific SNMP command can trigger a high CPU usage Denial of Service in the RPD daemon.
In a Point-to-Multipoint (P2MP) Label Switched Path (LSP) scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon (RPD) in Juniper Networks Junos OS allows a specific SNMP request to trigger an infinite loop causing a high …
-
Medium 5.0
Missing permission checks in Jenkins Amazon EC2 Plugin
A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.
-
Medium 6.5
phpBB allows CSRF
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.
-
Medium 4.3
phpBB Cross-Site Request Forgery (CSRF)
phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.
-
Medium —
Denial of service in ASP.NET Core
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
-
Medium 6.1
Drupal Cross-Site Scripting vulnerability
A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display.
-
Medium 5.3
Kubernetes ingress exposes sensitive information
Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.
-
Medium 5.3
Client Denial of Service on TUF
TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.
-
Medium 4.3
Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) do…
-
Medium 5.9
Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21…
-
Medium 5.4
SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to …
-
Medium 6.1
PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode …
-
Medium 4.8
XSS in Apache Airflow
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.
-
Medium 5.3
IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used …
-
Medium 5.1
IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local …