Archive
July 2020
Vulnerabilities first published in this month (UTC), newest first.
31 results · Clear filters · Feed
-
Low 3.7
An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the adm…
-
Low 3.1
IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, …
-
Low 3.1
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due …
-
Low 3.7
Log Injection
This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a …
-
Low 3.5
Integer Overflow in FreeRDP
In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepte…
-
Low 3.5
Invalidating or changing user does not invalidate session
When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects ((OTRS)) Community Edition: 6.0.28 and prior versions. OT…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Low 2.7
Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (compo…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are…
-
Low 2.7
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Page Request). Suppor…
-
Low 3.7
Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are J…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are a…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions tha…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions tha…
-
Low 2.7
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Environment Mgmt Consol…
-
Low 3.3
Vulnerability in the Oracle Solaris product of Oracle Systems (component: libsuri). The supported version that is affec…
-
Low 3.4
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: An…
-
Low 2.0
Vulnerability in the Hyperion Financial Close Management product of Oracle Hyperion (component: Close Manager). The sup…
-
Low 3.5
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Sup…
-
Low 2.8
Nested directory structure can lead to Uncontrolled Resource Consumption in freewvs
In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted us…
-
Low 3.5
Stored XSS in October
In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. Thi…
-
Low 2.8
Uncontrolled Resource Consumption in freewvs
In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1.
-
Low 2.7
SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to acce…
-
Low 3.1
IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cooki…
-
Low 3.7
Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites
In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467.
-
Low 3.3
Password stored in plain text by Jenkins HP ALM Quality Center Plugin
Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
-
Low 3.1
Passwords transmitted in plain text by Jenkins Stash Branch Parameter Plugin
Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
-
Low 2.7
IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users. The inform…
-
Low 2.7
IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive natur…
-
Low 3.7
IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or sess…