Archive
14 July 2020
Vulnerabilities first published on this day (UTC), newest first.
194 results · Feed
-
Unscored —
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All version…
-
Unscored —
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All version…
-
Unscored —
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All version…
-
Critical 9.8
Deserialization of Untrusted Data in Apache Dubbo
This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will e…
-
Medium 6.1
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Critical 9.1
IBM QRadar SIEM 7.3 and 7.4 could allow a remote privileged user to execute commands.
-
Medium 6.5
IBM QRadar SIEM 7.3 and 7.4 could allow an authenticated user to cause a denial of service of the qflow process by send…
-
High 7.6
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A …
-
Medium 5.4
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Unscored —
The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER a…
-
Unscored —
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is…
-
Unscored —
An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. There ar…
-
Unscored —
An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices. Attack…
-
Unscored —
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. Attacker…
-
Unscored —
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is…
-
Critical 9.8
SQL Injection in Kylin
Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Us…
-
Critical 9.8
Command Injection in Kylin
Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to exe…
-
Unscored —
Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (X…
-
Medium 4.2
SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user…
-
Medium 6.3
Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cook…
-
Critical 10.0
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication …
KEV Nov 3, 2021 -
Medium 6.1
SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controll…
-
Medium 5.4
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited…
-
Medium 6.1
SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-cont…
-
Medium 5.4
SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to…
-
Medium 5.3
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configurati…
-
Medium 4.6
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to…
-
High 7.7
SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain co…
-
Medium 5.8
SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver…
-
Low 2.7
SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to acce…
-
Medium 4.3
SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be…
-
Unscored —
In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.
-
Unscored —
mach is unmaintained
Last release was almost 4 years ago. Maintainer(s) seem to be completely unreachable. ## Possible Alternative(s) These may or may not be suitable alternatives and have not been vetted in any way; - [mach2](https://crates.io/crates/mach2) - direct fork
-
Unscored —
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in …