CVE-2020-28872
An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized person to create valid credentials. Devamını Oku
Devamını oku
CVE-2019-17656
A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1.2.9 and below, 2.0.0 and below may allow an authenticated remote attacker to crash the service by sending a malformed PUT request to the server. Fortinet is not aware of any successful exploitation of…
CVE-2020-15942
An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile. Devamını Oku
CVE-2020-15734
An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same directory or sub-directories. This issue affects: Bitdefender Safepay versions prior to 25.0.7.29. Devamını Oku
CVE-2020-7924
Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21;…
CVE-2020-4920 (collaborative_lifecycle_management, doors_next, engineering_insights, engineering_lifecycle_management, engineering_requirements_management_doors_next, engineering_test_management, engineering_workflow_management, rational_engineering_lifecycle_manager, rational_quality_manager, rational_team_concert, removable_media_management, rhapsody_model_manager)
IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191396. Devamını Oku
CVE-2020-4964 (collaborative_lifecycle_management, doors_next, engineering_insights, engineering_lifecycle_management, engineering_requirements_management_doors_next, engineering_test_management, engineering_workflow_management, rational_engineering_lifecycle_manager, rational_quality_manager, rational_team_concert, removable_media_management, rhapsody_model_manager)
IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to phish other users. IBM X-Force ID: 192419. Devamını Oku
CVE-2020-4965 (collaborative_lifecycle_management, doors_next, engineering_insights, engineering_lifecycle_management, engineering_requirements_management_doors_next, engineering_test_management, engineering_workflow_management, rational_engineering_lifecycle_manager, rational_quality_manager, rational_team_concert, removable_media_management, rhapsody_model_manager)
IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192422. Devamını Oku
CVE-2020-15390
pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo. Devamını Oku
CVE-2019-15059
In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar without authentication or authorization. These configuration files have all PBX information including extension numbers, contacts, and passwords. Devamını Oku
CVE-2020-13566
SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability In admin/edit_group.php, when the POST parameter action is “Deleteâ€�, the POST parameter delete_group leads to a SQL injection. Devamını Oku
CVE-2020-13568
SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability in admin/edit_group.php, when the POST parameter action is “Submitâ€�, the POST parameter parent_id leads to a SQL injection. Devamını Oku