Rock RMS File Upload / Account Takeover / Information Disclosure

Title ========================= Multiple vulnerabilities found in Rock RMS including RCE and account takeover. A total of three CVEs were issued for the vulnerabilities CVE-2019-18641, CVE-2019-18642, CVE-2019-18643 Product Description ========================= Rock RMS is an open source CRM...

Denial Of Service (DoS)

Xen is vulnerable to denial of service. A stack overflow due to recursive function calls allows an attacker to crash the application...

Zammad Access Control Error Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An access control error vulnerability exists in Zammad versions prior to 3.5.1. An attacker can exploit this vulnerability to bypass auditing and change Ticket Article data via REST API calls...

Denial Of Service (DoS)

gobby is vulnerable to denial of service DoS. The vulnerability exists through a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

CVE-2020-35450

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

CVE-2020-35450

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

CVE-2020-35450

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

Null pointer dereference

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

CVE-2020-35450

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain setlanguage calls...

CVE-2020-35450

Gobby 0.4.11 is affected by a NULL pointer dereference in the D-Bus handler for certain set_language calls. The issue, described as a denial-of-service risk (crash) on the targeted app, is noted across multiple advisories (e.g., Arch Linux ASA-202101-26) with upstream fixes referenced (upgrade to...

Microsoft Warns CrowdStrike of Hackers Targeting Azure Cloud Customers

New evidence amidst the ongoing probe into the espionage campaign targeting SolarWinds has uncovered an unsuccessful attempt to compromise cybersecurity firm Crowdstrike and access the company's email. The hacking endeavor was reported to the company by Microsoft's Threat Intelligence Center on...

An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.

...

The vulnerability of the Linux operating system’s kernel, related to the use of memory after it is freed, allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to disclose sensitive information by using system calls such as ioctls KDGKBSENT and KDSKBSENT...

CVE-2020-35609

A denial-of-service vulnerability exists in the asynchronous ioctl functionality of Microsoft Azure Sphere 20.05. A sequence of specially crafted ioctl calls can cause a denial of service. An attacker can write shellcode to trigger this vulnerability...

Design/Logic Flaw

An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class defined within PHP or MediaWiki via a crafted HTML comment, related to a Smarty template. For example...

MediaWiki 安全漏洞

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.35.1 and earlier...

CVE-2020-26251

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run...

CVE-2020-26251

Open Zaak (version prior to 1.3.3) had a wide-open CORS policy allowing any client, which could enable cross-origin scripts to access the API. The CVE notes that Open Zaak 1.3.3 disables CORS by default, with opt-in possible via environment variables. The publicly provided documents state that ex...

Open Zaak Access Control Error Vulnerability

Open Zaak is a Python-based data and service layer application from the Open Zaak team. The software can Zaakgericht Werken interact. Open Zaak before version 1.3.3 suffers from an Access Control Error vulnerability that stems from the fact that the cross-domain resource sharing policy is current...

AIX 7.2 TL 3 : perl (IJ26986)

https://vulners.com/cve/CVE-2020-10543 https://vulners.com/cve/CVE-2020-10543 Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Perl before 5.30.3 has an integer overflow related to mishandling of a...