Archive
March 2020
Vulnerabilities first published in this month (UTC), newest first.
177 results · Clear filters · Feed
-
Medium 6.5
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
Medium 6.2
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
Medium 5.3
An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB366…
-
Medium 4.3
phpBB Cross-Site Request Forgery (CSRF)
Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.
-
Medium 4.7
SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the at…
-
Medium 4.7
SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning m…
-
Medium 6.1
SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31…
-
Medium 4.3
The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 60…
-
Medium 5.5
SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; doe…
-
Medium 6.1
The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlle…
-
Medium 5.4
The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template…
-
Medium 5.4
The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and…
-
Medium 5.4
SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser hi…
-
Medium 6.8
A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The two FTP services (default …
-
Medium 6.5
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The DOWNLOADS section in th…
-
Medium 6.3
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The web interface of the Co…
-
Medium 5.3
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), SiNVR/SiVMS Video Server (A…
-
Medium 4.3
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (…
-
Medium 6.1
A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The web interface of the Co…
-
Medium 4.3
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search re…
-
Medium 5.4
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users …
-
Medium 5.4
IBM Tivoli Workload Scheduler 9.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit…
-
Medium 4.3
Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util
vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.
-
Medium 5.5
Froxlor Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if…
-
Medium 6.1
Froxlor Information Disclosure
An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, becaus…
-
Medium 6.1
Jenkins Subversion Release Manager Plugin vulnerable to cross-site scripting (XSS)
Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
-
Medium 4.3
Missing permission checks in Mac Plugin
A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.
-
Medium 4.3
CSRF vulnerability in Mac Plugin
A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
-
Medium 6.8
Missing SSH host key validation in Mac Plugin
Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
-
Medium 4.3
Missing permission checks in Jenkins P4 Plugin
A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.
-
Medium 4.3
CSRF vulnerability in Jenkins P4 Plugin
A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce.
-
Medium 6.1
XSS vulnerability in Jenkins Audit Trail Plugin
Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
-
Medium 6.5
Arbitrary file write vulnerability in Jenkins Cobertura Plugin
An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system.
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Jenkins Git Plugin
Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
-
Medium 4.8
Stored XSS vulnerability in Jenkins Timestamper Plugin
Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
-
Medium 6.4
nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusi…
-
Medium 6.1
CKEditor 4.0 vulnerability in the HTML Data Processor
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
-
Medium 6.5
Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send …
-
Medium 4.6
A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are st…
-
Medium 6.7
Cisco Remote PHY Device Software Command Injection Vulnerability
A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exists because the affected software does not prop…