|
208551
|
4.4 |
MEDIUM
Local
|
paloaltonetworks
|
pan-os
vm-series
|
TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect Azure dashboard service account credent…
|
CWE-522
Insufficiently Protected Credentials
|
CVE-2020-1978
|
2024-11-21 14:11 |
2020-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208552
|
5.4 |
MEDIUM
Network
|
redhat
quarkus
|
keycloak
quarkus
|
A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does n…
|
CWE-1021
Improper Restriction of Rendered UI Layers or Frames
|
CVE-2020-1728
|
2024-11-21 14:11 |
2020-04-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208553
|
6.1 |
MEDIUM
Network
|
apache
fedoraproject
debian
canonical
opensuse
netapp
broadcom
oracle
|
http_server
fedora
debian_linux
ubuntu_linux
leap
oncommand_unified_manager_core_package
brocade_fabric_operating_system
sd-wan_aware
instantis_enterprisetrack
communicatio…
|
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL…
|
CWE-601
Open Redirect
|
CVE-2020-1927
|
2024-11-21 14:11 |
2020-04-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208554
|
6.5 |
MEDIUM
Network
|
apache
|
druid
|
When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if…
|
CWE-74
Injection
|
CVE-2020-1958
|
2024-11-21 14:11 |
2020-04-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208555
|
5.3 |
MEDIUM
Adjacent
|
apache
oracle
netapp
|
cxf
peoplesoft_enterprise_peopletools
communications_diameter_signaling_router
communications_session_report_manager
communications_element_manager
enterprise_manager_base_platform
…
|
Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationMa…
|
NVD-CWE-noinfo
|
CVE-2020-1954
|
2024-11-21 14:11 |
2020-04-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208556
|
5.3 |
MEDIUM
Network
|
apache
fedoraproject
debian
canonical
opensuse
oracle
|
http_server
fedora
debian_linux
ubuntu_linux
leap
instantis_enterprisetrack
communications_element_manager
enterprise_manager_ops_center
communications_session_report_manager<…
|
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
|
CWE-908
Use of Uninitialized Resource
|
CVE-2020-1934
|
2024-11-21 14:11 |
2020-04-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208557
|
6.1 |
MEDIUM
Network
|
apache
|
sling_cms
|
Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attack…
|
CWE-79
Cross-site Scripting
|
CVE-2020-1949
|
2024-11-21 14:11 |
2020-04-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208558
|
6.1 |
MEDIUM
Network
|
apache
|
ofbiz
|
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
|
CWE-79
Cross-site Scripting
|
CVE-2020-1943
|
2024-11-21 14:11 |
2020-04-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208559
|
7.8 |
HIGH
Local
|
systemd_project
redhat
debian
|
systemd
enterprise_linux
openshift_container_platform
discovery
migration_toolkit
ceph_storage
debian_linux
|
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse…
|
CWE-416
Use After Free
|
CVE-2020-1712
|
2024-11-21 14:11 |
2020-04-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208560
|
8.1 |
HIGH
Network
|
otrs
|
otrs
|
An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, passw…
|
CWE-331
Insufficient Entropy
|
CVE-2020-1773
|
2024-11-21 14:11 |
2020-03-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
