CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743 Prototype Pollution

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743

The vulnerability described in CVE-2020-7743 affects the mathjs package prior to version 7.5.1, enabling Prototype Pollution via the deepExtend function during configuration updates. This is a general software vulnerability in mathjs, with no explicit exploit details provided in the connected doc...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743: Improperly Controlled Modification of Object Prototype Attributes

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

PT-2020-19760

Name of the Vulnerable Software and Affected Versions mathjs versions prior to 7.5.1 Description The issue concerns Prototype Pollution via the deepExtend function, which is triggered by configuration updates. This function is part of the mathjs package. Recommendations For versions prior to 7.5....

Prototype Pollution

Overview mathjs is a math library for JavaScript and Node.js. It features a flexible expression parser with support for symbolic computation, comes with a large set of built-in functions and constants, and offers an integrated solution to work with diff. Affected versions of this package are...

Attacks Aimed at Disrupting the Trickbot Botnet

Over the past 10 days, someone has been launching a series of coordinated attacks designed to disrupt Trickbot, an enormous collection of more than two million malware-infected Windows PCs that are constantly being harvested for financial data and are often used as the entry point for deploying...

Cisco IOS Software Information Disclosure Vulnerability (cisco-sa-20190327-info)

According to its self-reported version, Cisco IOS Software is affected by an unspecified vulnerability in the Secure Storage feature of Cisco IOS that allows an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper memory...

Cisco IOS XE Software Information Disclosure Vulnerability (cisco-sa-20190327-info)

According to its self-reported version, Cisco IOS XE Software is affected by an unspecified vulnerability in the Secure Storage feature of Cisco IOS XE that allows an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper...

Design/Logic Flaw

A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper memory operations performed at encryption time, when affected software...

CVE-2019-1762

A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper memory operations performed at encryption time, when affected software...

CVE-2019-1762

Cisco IOS and IOS XE Information Disclosure vulnerability (CVE-2019-1762) arises from improper memory operations in the Secure Storage feature during encryption of configuration updates. An authenticated, local attacker could retrieve contents of memory locations and disclose keying materials emb...

Cisco IOS and IOS XE Software Information Disclosure Vulnerability

A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper memory operations performed at encryption time, when affected software...

CVE-2018-8855

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow unencrypted Web connections by default, and devices can receive configuration and firmware updates by unsecure FTP...

CVE-2016-6564

CVE-2016-6564 concerns Ragentek Android firmware that embeds a privileged OTA update binary (/system/bin/debugs) which communicates with three HTTP hosts over an unencrypted channel. The rootkit-like binary runs with root privileges and can execute arbitrary root commands in responses from the se...

SUSE-RU-2018:1071-1 Recommended update for several crowbar barclamps

This update for Crowbar provides several fixes and improvements for the following barclamps: crowbar-openstack: - nova: Use internal placement url bsc1055188 - nova: Subscribe to placement config bsc1055188 - barbican: Add missing roles used in policy.json bsc1081573 - barbican: Add creator role...

CVE-2018-8972

Creditwest Bank CMS Project aka CWCMS through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a PHP shell that calls eval on request parameters...

UBUNTU-CVE-2016-0764

Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary...

BigTree Object Injection Vulnerability

Fastspot BigTree is a PHP and MySQL based open source content management system . An object injection vulnerability exists in BigTree 4.2.8, which can be exploited by an attacker to disallow configuration updates by default...