[ASA-202009-9] chromium: multiple issues

Arch Linux Security Advisory ASA-202009-9 ========================================= Severity: High Date : 2020-09-23 CVE-ID : CVE-2020-15960 CVE-2020-15961 CVE-2020-15962 CVE-2020-15963 CVE-2020-15964 CVE-2020-15965 CVE-2020-15966 Package : chromium Type : multiple issues Remote : Yes Link :...

PT-2020-16208

Name of the Vulnerable Software and Affected Versions Tiny Tiny RSS versions prior to 2020-09-16 Description A problem was discovered in Tiny Tiny RSS where the imgproxy function in the plugins/af proxy http/init.php file mishandles the url variable in an error message. Recommendations For versio...

PT-2020-16206 · D Link +1 · D-Link Dir-816L +2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816L version 2.06.B09 BETA D-Link DIR-803 version 1.04.B02 Description: The issue allows for XSS via the HTTP Referer header in the webinc/js/info.php file. This typically is not exploitable due to URL encoding, except in Internet...

PT-2020-14622 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions 2017.1 through 2020.2.4 Description: An issue was discovered where the /usage page of Gradle Enterprise conveys high-level build information, such as project names and build counts over time, and this page is...

PT-2020-14615 · Gradle · Gradle Enterprise +1

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions 2017.3 through 2020.2.4 Gradle Enterprise Build Cache Node versions 1.0 through 9.2 Description: An issue in Gradle Enterprise allows remote attackers to obtain authentication cookies through unrestricted HTTP heade...

Security update for pdns-recursor (moderate)

openSUSE Security Update: Security update for pdns-recursor Announcement ID: openSUSE-SU-2020:1101-1 Rating: moderate References: 1173302 Cross-References: CVE-2020-14196 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes one vulnerability is now available. Description:This...

Security update for pdns-recursor (moderate)

openSUSE Security Update: Security update for pdns-recursor Announcement ID: openSUSE-SU-2020:1055-1 Rating: moderate References: 1173302 Cross-References: CVE-2020-14196 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes one vulnerability is now available. Description:This...

JVN#31864411: Multiple access restriction bypass vulnerabilities in UNIQLO App

UNIQLO App provided by UNIQLO CO., LTD. contains multiple access restriction bypass vulnerabilities below. A remote attacker may be able to lead a user to access an arbitrary website via the vulnerable App. The App launched by a Custom URL Scheme may lead a user to access an arbitrary URL -...

CVE-2020-13308

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance...

PT-2020-15384

Name of the Vulnerable Software and Affected Versions Gazie version 7.29 Description The issue allows for Cross Site Scripting XSS via the "http://192.168.100.7/gazie/modules/config/admin utente.php" endpoint, specifically through the user name variable. An attacker can inject JavaScript code,...

Node.js third-party modules: [json8-merge-patch] Prototype Pollution

I would like to report a Prototype Pollution vulnerability in json8-merge-patch The apply function fails to restrict access to prototypes of objects, allowing for modification of prototype behavior. Module module name: json8-merge-patch version: v1.0.1 npm page:...

CVE-2020-25283

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. BT manager allows attackers to bypass intended access restrictions on a certain mode. The LG ID is LVE-SMP-200021 September 2020...

CVE-2020-25283

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. BT manager allows attackers to bypass intended access restrictions on a certain mode. The LG ID is LVE-SMP-200021 September 2020...

CVE-2020-25283

CVE-2020-25283 affects LG mobile devices running Android 8.x–10. The issue is described as the BT Manager bypassing intended access restrictions on a certain mode. The connected records indicate the affected product family (LG Android devices) and component involved (BT Manager), but do not provi...

PT-2020-14819 · Philips · Patient Information Center Ix +1

Name of the Vulnerable Software and Affected Versions: Patient Information Center iX PICiX versions C.02 through C.03 PerformanceBridge Focal Point version A.01 Description: The product receives input that is expected to be well-formed but does not validate or incorrectly validates that the input...

PT-2020-6803 · Nlnet +8 · Nsd +9

Name of the Vulnerable Software and Affected Versions: NLnet Labs Unbound versions up to and including 1.12.0 NLnet Labs NSD versions up to and including 4.3.3 Description: The issue is related to a local vulnerability that allows for a local symlink attack. When writing the PID file, Unbound and...

[ASA-202009-6] chromium: multiple issues

Arch Linux Security Advisory ASA-202009-6 ========================================= Severity: High Date : 2020-09-09 CVE-ID : CVE-2020-6573 CVE-2020-6574 CVE-2020-6575 CVE-2020-6576 CVE-2020-6579 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1225...

PT-2020-4075 · Microsoft · Sharepoint Foundation +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Foundation affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: A cross-site-scripting XSS issue...

GHSA-54XJ-Q58H-9X57 Arbitrary File Write in iobroker.admin

Versions of iobroker.admin prior to 3.6.12 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended folder in the /log/ route, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform...

GHSA-JP99-5H8W-GMXC Sandbox Breakout / Arbitrary Code Execution in @zhaoyao91/eval-in-vm

All versions of @zhaoyao91/eval-in-vm are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through this.constructor.constructor . This may allow attackers to execute arbitrary code in the system. Evaluating the payload...