Show filters
498 topics marked with the following tags:
Displaying 1-10 of 498
Sort by:
Attacker Value
Unknown
CVE-2019-15637
Disclosure Date: August 26, 2019 (last updated October 06, 2023)
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.
1
Attacker Value
Very High
CVE-2019-18393
Disclosure Date: October 24, 2019 (last updated October 06, 2023)
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.
4
Attacker Value
High
CVE-2020-10535
Disclosure Date: March 12, 2020 (last updated October 06, 2023)
GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address.
4
Attacker Value
Unknown
CVE-2021-42574
Disclosure Date: November 01, 2021 (last updated November 08, 2023)
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements o…
1
Attacker Value
Very Low
CVE-2020-1296 Windows Diagnostics & feedback Information Disclosure Vulnerabili…
Disclosure Date: June 09, 2020 (last updated October 06, 2023)
A vulnerability exists in the way the Windows Diagnostics & feedback settings app handles objects in memory, aka 'Windows Diagnostics & feedback Information Disclosure Vulnerability'.
0
Attacker Value
Very High
CVE-2019-18394
Disclosure Date: October 24, 2019 (last updated October 06, 2023)
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
3
Attacker Value
Low
CVE-2020-1315 Internet Explorer Information Disclosure Vulnerability
Last updated June 09, 2020
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website in an attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site.
The security update addresses the vulnerability by modifying how Internet Explorer handles objects in memory.
1
Attacker Value
Very High
CVE-2020-6364 — OS Command Injection Vulnerability in CA Introscope Enterprise …
Disclosure Date: October 15, 2020 (last updated October 07, 2023)
SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that OS commands can be executed and potentially gain control over the host running the CA Introscope Enterprise Manager,leading to Code Injection. With this, the attacker is able to read and modify all system files and also impact system availability.
0
Attacker Value
High
CVE-2021-26897
Disclosure Date: March 11, 2021 (last updated December 30, 2023)
Windows DNS Server Remote Code Execution Vulnerability
5
Attacker Value
Very High
CVE-2020-10977
Disclosure Date: April 08, 2020 (last updated October 06, 2023)
GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.
1