Information disclosure

Insecure permissions 777 are set on $HOME/.singularity when it is newly created by Singularity version from 3.3.0 to 3.5.1, which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services...

CVE-2019-19724

Insecure permissions 777 are set on $HOME/.singularity when it is newly created by Singularity version from 3.3.0 to 3.5.1, which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services...

Design/Logic Flaw

In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details...

PT-2019-6268 · Inspircd +4 · Inspircd +4

Name of the Vulnerable Software and Affected Versions: InspIRCd versions prior to 2.0.28 InspIRCd versions prior to 3.3.0 Description: The issue is related to a NULL pointer dereference in the mysql module of InspIRCd when built against mariadb-connector-c 3.0.5 or newer. This can be exploited fo...

Linaro OP-TEE Buffer Overflow Vulnerability (CNVD-2019-22865)

Linaro OP-TEE is an open source trusted execution environment from Linaro UK. A buffer overflow vulnerability exists in opteeos in Linaro OP-TEE 3.3.0 and earlier versions. The vulnerability stems from a networked system or product performing operations on memory without properly validating data...

Linaro OP-TEE Input Validation Error Vulnerability

Linaro OP-TEE is an open source trusted execution environment from Linaro UK. A security vulnerability exists in opteeos in Linaro OP-TEE 3.3.0 and earlier versions. An attacker could exploit this vulnerability to cause TEE memory corruption...

CVE-2019-1010295

Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Memory corruption and disclosure of memory content. The component is: opteeos. The fixed version is: 3.4.0 and later...

CVE-2019-1010298

Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of TEE core kernel. The component is: opteeos. The fixed version is: 3.4.0 and later...

Buffer overflow

Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Execution of code in TEE core kernel context. The component is: opteeos. The fixed version is: 3.4.0 and later...

CVE-2019-1010294

Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Rounding error. The impact is: Potentially leaking code and/or data from previous Trusted Application. The component is: opteeos. The fixed version is: 3.4.0 and later...

PT-2019-11547

Name of the Vulnerable Software and Affected Versions: Linaro/OP-TEE OP-TEE versions 3.3.0 and earlier Description: The issue affects the optee os component and is related to a buffer overflow, which can lead to memory corruption and disclosure of memory content. Recommendations: For versions 3.3...

CVE-2019-9150

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported...

CVE-2019-9150

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported...

CVE-2018-16249

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...

Code injection

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...

ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1 <=1.2.8), ai.tripl:arc-big-query-pipeline-plugin_2.12 (>=1.0.0 <=1.8.0) +2737 more potentially affected by CVE-2019-0201 via org.apache.zookeeper:zookeeper (>=3.3.0 <=3.4.13)

org.apache.zookeeper:zookeeper MAVEN version =3.3.0, =1.0.1, =1.0.0, =1.4.0, =1.4.0, =1.0.0, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.3.0, =1.3.0, =1.0.0, =3.0.0, =1.0, =1.2 - ca.innovativemedicine:vcfimp-solr2.10 =0.7.0 and more Source cves: CVE-2019-0201 Source advisory: OSV:GHSA-2HW2-62CP-P9P7...

Design/Logic Flaw

In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled ...

CVE-2019-11037

In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled ...

CVE-2011-1830

Ekiga versions before 3.3.0 attempted to load a module from /tmp/ekigatest.so...

Atlassian Crowd Authentication Bypass Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. A security vulnerability exists in Atlassian Crowd versions prior to 3.2.7 and version...