UBUNTU-CVE-2020-6106

An exploitable information disclosure vulnerability exists in the initnodemanager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted filesystem can be used to disclose information. An attacker can provide a malicious file to trigger this vulnerability...

PT-2020-6547 · Unknown +1 · F2Fs-Tools +1

Name of the Vulnerable Software and Affected Versions: F2fs-Tools F2fs.Fsck versions 1.12 through 1.13 Description: An information disclosure issue exists in the init node manager functionality. A specially crafted filesystem can be used to disclose information. An attacker can provide a maliciou...

PT-2020-15457 · Jenkins · Jenkins Yet Another Build Visualizer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Yet Another Build Visualizer Plugin versions 1.11 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. This occurs because the plugin does not escape tooltip content, allowing users with...

CVE-2020-15105

Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...

CVE-2020-12712

A vulnerability based on insecure user/password encryption in the JOE job editor component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile...

Security feature bypass

A vulnerability based on insecure user/password encryption in the JOE job editor component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile...

PT-2020-15409 · Jenkins · Jenkins Compact Columns Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Compact Columns Plugin versions 1.11 and earlier Description: The issue results in a stored cross-site scripting vulnerability. This can be exploited by users with Job/Configure permission, as the unprocessed job description is...

CVE-2020-11539

An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing mode 0 Bluetooth LE security level The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any...

CVE-2020-11539

CVE-2020-11539 affects Tata Sonata Smart SF Rush v1.12. The connected sources describe a Bluetooth Low Energy security flaw where OTA data is unencrypted and there is no authentication/signature verification, allowing an attacker to influence device parameters. Root cause: lack of pairing securit...

CVE-2020-5560

WL-Enq 1.11 and 1.12 allows remote attackers to execute arbitrary OS commands with the administrative privilege via unspecified vectors...

CVE-2020-5560

WL-Enq 1.11 and 1.12 allows remote attackers to execute arbitrary OS commands with the administrative privilege via unspecified vectors...

WL Enq Operating System Command Execution Vulnerability

The WonderLink WL-Enq is a CGI Common Gateway Interface that provides network survey functionality. A security vulnerability exists in WonderLink WL-Enq versions 1.11 and 1.12. A remote attacker could exploit the vulnerability to execute arbitrary operating system commands with administrative...

WonderLink WL-Enq Cross-Site Scripting Vulnerability

The WonderLink WL-Enq is a CGI Common Gateway Interface that provides network survey functionality. A cross-site scripting vulnerability exists in WonderLink WL-Enq versions 1.11 and 1.12. The vulnerability stems from the WEB application lacking proper validation of client data. An attacker could...

PT-2020-19895 · Intellian · Intellian Satellian +1

Name of the Vulnerable Software and Affected Versions: Intellian Aptus Web version 1.24 Intellian Satellian version 1.12 Description: The issue allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the "cgi-bin/libagent.cgi" URI. A valid sid cookie for a log...

RHEL 7 : go-toolset-1.12-golang (RHSA-2020:0101)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0101 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The following packages have been...

Moderate: Red Hat Enhancement Advisory: new packages: go-toolset-1.12

New go-toolset-1.12 packages are now available as a part of Red Hat Developer Tools for Red Hat Enterprise Linux. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. This enhancement update adds the go-toolset-1.12 packages to Red Hat Develope...

kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be...

CVE-2019-9516

A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially...

Input validation

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming...

Kubernetes 1.11.x < 1.11.9 / 1.12.x < 1.12.7 / 1.13.x < 1.13.5 kubectl directory traversal

The version of Kubernetes installed on the remote host is version 1.11.x prior to 1.11.9, 1.12.x prior to 1.12.7 or 1.13.x prior to 1.13.5. It is, therefore, affected by a directory traversal vulnerability in the kubectl cp command due to mishandling of symlinks when copying files from a running...