1E Client Elevation of Privilege Vulnerability

1E Client is an agent-less endpoint management software from 1E 1E Client USA. An elevation of privilege vulnerability exists in 1E Client versions 4.1.0.267 and 5.0.0.745 that allows remote authenticated users and local users to gain elevated privileges via the REPAIR option. This applies to...

1E Client Privilege Permission and Access Control Issues Vulnerability

1E Client is an agent-less endpoint management software from 1E USA. A security vulnerability exists in 1E Client version 5.0.0.745 that stems from %PROGRAMFILES%1EClientTachyon.Performance.Metrics.exe failing to handle unreferenced paths. This may allow a remote attacker to gain elevated...

CVE-2020-16268

The CVE-2020-16268 entry concerns the 1E Client MSI installer (versions 4.1.0.267 and 5.0.0.745). The flaw arises when using the repair option with a Transform (MST) that can disable the Nomad module; an attacker can craft a .reg file in a specific location to write to any registry key as an elev...

mysql: C API unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

CVE-2020-25860

The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is...

HCL Notes 缓冲区错误漏洞

HCL Notes is a highly secure local email client from HCL India. HCL Notes v9 client has an authorization issue vulnerability that stems from A vulnerability in MIME message handling could be exploited by an unauthenticated attacker to cause a stack buffer overflow. A remote attacker could use thi...

mysql: C API unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise...

mysql: C API unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise...

Command Execution Vulnerability in JetSpeed OCR Text Recognition Software

JetSpeed OCR text recognition software is an image and text recognition software with high recognition rate, with batch processing and high-speed recognition; the software supports multi-language recognition, support for a variety of file formats such as: JPG, GIF, PNG, BMP, TIF, PDF files and...

kernel: TOCTOU mismatch in the NFS client code

A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response allow for local memory corruption and possibly privilege escalation...

Command Execution Vulnerability in Followers (Windows Client)

Followers Learning, which is affiliated with Beijing Baike Internet Technology Co. The program services provided by Followers Learning cover the categories of primary and secondary school culture classes, practical English, workplace, certification, study abroad, graduate school, family education...

mysql: C API unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

DEBIAN-CVE-2020-15693

In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call such as httpClient.get or httpClient.post, the User-Agent header value, or custom HTTP header names or value...

CVE-2020-16143

The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory...

The vulnerability of the tls_trust_file command in the SMTP client Msmtp and the POP3 client Mpop allows attackers to compromise the integrity, availability, and confidentiality of information.

The vulnerability of the tlstrustfile command in the SMTP client Msmtp and the POP3 client Mpop is related to incorrect authentication of the certificate’s authenticity. Exploiting this vulnerability allows a malicious actor to compromise the integrity, availability, and confidentiality of...

VMware Horizon Client Elevation of Privilege Vulnerability

VMware Horizon Client is a client application for connecting to VMware Horizon virtual desktops from VMware. An elevation of privilege vulnerability exists in VMware Horizon Client 5.x and earlier versions for Windows-based platforms, which can be exploited by a local attacker to run commands as ...

CVE-2020-5898

In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland. A local user on the Windows client system can send crafted DeviceIoControl requests to \.\urvpndrv device causing the Windows kernel to crash...

Authorization

Actions Http-Client NPM @actions/http-client before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request...

Shenzhen Tencent Computer System Limited Tencent Game Box suffers from DLL hijacking vulnerability

Tencent game box is specially designed for web users to create game aids, with original hang-up bodyguard, convenient account multi-opening, exclusive game acceleration, selected game recommendations, high-quality game strategy, one-stop gift packages and other features. Shenzhen Tencent Computer...

Shanghai Qingman Network Technology Co., Ltd. 11 Matchmaking Platform has dll Hijacking Vulnerability

11 Matchmaking Platform is an eSports matchmaking platform developed by Gaming Network which has more than one game online matchmaking. Shanghai Qingman Network Technology Co., Ltd. 11 against the platform exists dll hijacking vulnerability, attackers can use the vulnerability in the client proce...