Archive
10 June 2020
Vulnerabilities first published on this day (UTC), newest first.
19 results · Clear filters · Feed
-
Medium 6.5
Liferay Portal and Liferay DXP Fails to Sanitize API Data
Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to…
-
Medium 5.3
GlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookie
When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication cookie to a man-in-the-middle attacker on the same local area network segment with the ability to manip…
-
Medium 6.5
Openstack cinder Improper handling of ScaleIO backend credentials
An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using ope…
-
Medium 6.1
A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Ed…
-
Medium 5.3
A specially crafted request could be used to confirm the existence of files hosted on object storage services, without …
-
Medium 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in Gi…
-
Medium 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all …
-
Medium 5.9
IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong pas…
-
Medium 5.4
SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due …
-
Medium 6.9
Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10…
-
Medium 6.5
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed…
-
Medium 4.3
Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access…
-
Medium 6.5
SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not pe…
-
Medium 5.4
Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 8…
-
Medium 6.1
SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750,…
-
Medium 4.4
Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissio…
-
Medium 6.3
Using VSE to bypass Windows Credentials on Lock screen
Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow unauthorized users to interact with the On-Access Scan Messages - Threat Alert Window when the Windows Login Scree…
-
Medium 4.6
DLL search order hijacking in Host IPS
DLL Search Order Hijacking Vulnerability in the installer component of McAfee Host Intrusion Prevention System (Host IPS) for Windows prior to 8.0.0 Patch 15 Update allows attackers with local access to execute arbitrary code via execution from a compromised …
-
Medium 5.9
DLL search order hijacking in MA
DLL Search Order Hijacking vulnerability in McAfee Agent (MA) prior to 5.6.4 allows attackers with local access to execute arbitrary code via execution from a compromised folder.