641 matches found
CVE-2020-27617
ethgetgsotype in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol...
CVE-2020-27617
ethgetgsotype in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol...
CVE-2020-27616
CVE-2020-27616 : In QEMU 4.2.1, ati_2d_blt in hw/display/ati_2d.c can trigger an outside-limits calculation, allowing a guest to crash the QEMU process. Connected advisories (Astra Linux, openSUSE/SUSE) reference this exact issue and list it among other QEMU fixes, but no explicit remediation or ...
CVE-2020-27616
ati2dblt in hw/display/ati2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process...
GHSA-QGFR-5HQP-VRW9 Path Traversal in decompress
Versions of decompress prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing../. Recommendation Upgrade to version 4.2.1 or later...
GHSA-FF7X-QRG7-QGGM dot-prop Prototype Pollution vulnerability
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects...
SUSE-SU-2020:2015-1 Security update for qemu
This update for qemu to version 4.2.1 fixes the following issues: - CVE-2020-10761: Fixed a denial of service in Network Block Device nbd support infrastructure bsc1172710. - CVE-2020-13800: Fixed a denial of service possibility in ati-vga emulation bsc1172495. - CVE-2020-13659: Fixed a null...
Mattermost Server Input Validation Error Vulnerability (CNVD-2020-41500)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.3.0, 4.2.1 and 4.1.2. An attacker could exploit this vulnerability to cause a denial of service...
Mattermost Server Security Feature Issue Vulnerability
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.3.0, prior to 4.2.1, and prior to 4.1.2. An attacker could exploit the vulnerability to gain access to user accounts...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-41481)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.3.0, 4.2.1, and 4.1.2. An attacker can exploit this vulnerability to determine the existence of arbitrary files...
Mattermost Server Cross-Site Scripting Vulnerability (CNVD-2020-48232)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.3.0, 4.2.1 and 4.1.2. The vulnerability stems from the WEB application's lack of proper validation of client data. An attacke...
CVE-2017-18890
CVE-2017-18890 affects Mattermost Server prior to 4.3.0, 4.2.1, and 4.1.2. An attacker can craft a UI button that, when pressed by a user, triggers an API request. The vulnerability description across Red Hat/SUSE/SUSCVE and OSV confirms the same behavior and impact. Remediation guidance in sourc...
CVE-2017-18881
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a gotolocation response to a slash command...
PT-2020-8420
Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server when local storage for files is used, allowing a System Admin to achieve...
Cross site request forgery (csrf)
A Cross-Site Request Forgery CSRF vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a G...
Subrion CMS 4.2.1 Cross Site Request Forgery
Title: Subrion CMS 4.2.1 Cross-Site Request Forgery vulnerability CSRF Date: 01-12-2019 Author: Christian Bortone Contact: [email protected] Vendor Homepage: https://subrion.org/ Vulnerable Product: Subrion CMS 4.2.1 CVE : CVE-2019-20390 1. Description: A Cross-Site Request Forgery CSRF...
CVE-2020-12467
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...
CVE-2020-12467
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...