‼ CVE-2020-27988 ‼
📖 Read
via "National Vulnerability Database".
Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4665 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 186280.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27990 ‼
📖 Read
via "National Vulnerability Database".
Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23490 ‼
📖 Read
via "National Vulnerability Database".
There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4672 ‼
📖 Read
via "National Vulnerability Database".
IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4647 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4671 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 stores potentially sensitive information in log files that could be read by an authenticatedl user. IBM X-Force ID: 186284.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4763 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188897.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4655 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 186091.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4700 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user belonging to a specific user group to create a user or group with administrative privileges. IBM X-Force ID: 187077.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4705 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187190.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4476 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181778.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4475 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23489 ‼
📖 Read
via "National Vulnerability Database".
The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27991 ‼
📖 Read
via "National Vulnerability Database".
Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28723 ‼
📖 Read
via "National Vulnerability Database".
Memory leak in IPv6Param::setAddress in CloudAvid PParam 1.3.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27989 ‼
📖 Read
via "National Vulnerability Database".
Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4692 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user to obtain sensitive information from the Dashboard UI. IBM X-Force ID: 186780.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28692 ‼
📖 Read
via "National Vulnerability Database".
In Gila CMS 1.16.0, an attacker can upload a shell to tmp directy and abuse .htaccess through the logs function for executing PHP files.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4566 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 stores potentially highly sensitive information in log files that could be read by an authenticated user. IBM X-Force ID: 184083.📖 Read
via "National Vulnerability Database".
🦿 Cybersecurity: Top hackers make big money from bug bounties 🦿
📖 Read
via "Tech Republic".
You might not make a million dollars, but hackers are making good money from reporting vulnerabilities.📖 Read
via "Tech Republic".
TechRepublic
Meet the hackers who earn millions for saving the web. How bug bounties are changing everything about security
These hackers are finding security bugs--and getting paid for it. That's changing the dynamics of cybersecurity.