CVE-2020-13151

Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...

Remote code execution

Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...

CVE-2020-13151

CVE-2020-13151 affects the Aerospike Community Edition, specifically versions around 4.9.0.5. The vulnerability allows an unauthenticated user to submit a crafted Lua UDF that can execute arbitrary OS commands via os.execute(), enabling remote command execution on all cluster nodes with the Aeros...

CVE-2020-13151

Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...

PT-2020-13356 · Aerospike · Aerospike Community Edition

Name of the Vulnerable Software and Affected Versions: Aerospike Community Edition version 4.9.0.5 Description: The issue allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. Although it attempts to restrict code executio...

Aerospike Database UDF Lua Code Execution

Aerospike Database versions before 5.1.0.3 permitted user-defined functions UDF to call the os.execute Lua function. This module creates a UDF utilising this function to execute arbitrary operating system commands with the privileges of the user running the Aerospike service. This module does not...

ArticaTech Artica Proxy SQL Injection Vulnerability

ArticaTech Artica Proxy is an open source Artica proxy solution from the French company ArticaTech. A SQL injection vulnerability exists in ArticaTech Artica Proxy Community Edition versions prior to 4.28.030.418. The vulnerability stems from a lack of validation of externally entered SQL...

DEBIAN-CVE-2020-1776

When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects OTRS Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and...

CVE-2020-1776

When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects OTRS Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and...

CVE-2020-1776

When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects OTRS Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and...

CVE-2020-1776

When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects OTRS Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and...

PT-2020-15053 · Otrs +1 · Otrs Community Edition +2

Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions 6.0.28 and prior OTRS versions 7.0.18 and prior OTRS versions 8.0.4 and prior Description: The issue occurs when an agent user is renamed or set to invalid, and the session belonging to the user remains active...

Security Bulletin: WML CE: Pillow before 7.1.0 has multiple out-of-bounds reads

Summary Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. PyTorch and TensorFlow use Pillow. Vulnerability Details CVEID: CVE-2020-10177 DESCRIPTION: Pillow could allow a remote attacker to obtain sensitive information, caused by multiple out-of-bounds reads in...

Security Bulletin: WML CE: TensorBoard: Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack.

Summary Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. TensorBoard uses lodash. A remote attacker could exploit this vulnerability using the merge, mergeWith, and defaultsDeep functions to inject properties onto Object.prototype to crash the...

Security Bulletin: WML CE: libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read

Summary libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in getrgbrow in rdppm.c via a malformed PPM input file. Vulnerability Details CVEID: CVE-2020-13790 DESCRIPTION: Libjpeg-turbo is vulnerable to a denial of service, caused by heap-based buffer over-read in getrgbrow...

Privilege Escalation

magento/community-edition is vulnerable to privilege escalation. A business logic flaw allows an attacker to gain higher privileges...

Arbitrary Code Execution

magento/community-edition is vulnerable to arbitrary code execution. The vulnerability exists due to a security mitigation bypass weakness...

Arbitrary Code Execution

magento/community-edition is vulnerable to arbitrary code execution. The vulnerability exists through a security mitigation bypass weakness...

Arbitrary Code Execution

magento/community-edition is vulnerable to arbitrary code execution. A successful exploitation allows an attacker to inject and execute arbitrary commands on the system...

Arbitrary Code Execution

magento/community-edition is vulnerable to arbitrary code execution. A successful exploitation allows an attacker to inject and execute arbitrary commands on the system...