NewStart CGSL MAIN 6.01 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0036)

The remote NewStart CGSL host, running version MAIN 6.01, has thunderbird packages installed that are affected by multiple vulnerabilities: - By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This...

CVE-2020-4462

IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...

The vulnerability of the jdhuff.c component in the libjpeg image processing library allows a hacker to disclose protected information or cause service failures.

The vulnerability of the jdhuff.c component in the libjpeg library relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to disclose protected information or cause service failures...

USN-4421-1 thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbtirary code. CVE-2020-12405,...

hanakhabar.ir Cross Site Scripting vulnerability OBB-1218820

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Huawei P30 and P30 Pro Information Disclosure Vulnerability

The Huawei P30 and Huawei P30 Pro are both smartphones from the Chinese company Huawei Huawei. A security vulnerability exists in Huawei P30 versions prior to 10.1.0.160 C00E160R2P11 and P30 Pro versions prior to 10.1.0.160 C00E160R2P8. An attacker can exploit the vulnerability by spoofing a WI-F...

The vulnerability of the component libvncserver/corre.c in the cross-platform library LibVNCServer allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the component libvncserver/corre.c in the cross-platform library LibVNCServer arises from an operation that occurs outside the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and...

A vulnerability in the web access function of the microprogramming software used in Cisco IP Phones 7800 and Cisco IP Phones 8800 allows a perpetrator to disclose protected information.

The vulnerability in the web access function of Cisco IP Phones 7800 and Cisco IP Phones 8800 is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information by sending specially crafted requests to the vulnerable...

CVE-2020-5969

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which it validates a shared resource before using it, creating a race condition which may lead to denial of service or information disclosure. This affects vGPU version 8.x prior to 8.4, version 9.x prior to 9.4 and versio...

CVE-2020-5968

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed by using an index or pointer, such as memory or files, which may lead to code execution, denial ...

Design/Logic Flaw

BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data and the serial number from the implanted cardiac device the CardioMessenger is paired with...

PT-2020-4486 · Openjpeg +9 · Openjpeg +9

Name of the Vulnerable Software and Affected Versions: OpenJPEG versions through 2.3.1 Description: The issue is related to a use-after-free in the jp2/opj decompress.c component of the OpenJPEG library, which can be triggered by a mix of valid and invalid files in a directory operated on by the...

ACF to REST API < 3.3.0 - Unauthenticated Arbitrary wp_options Disclosure

The plugin does not properly check for authorisation and allowed options to be retrieved from the wp-json/acf/v3/options/ endpoint. This could allow unauthenticated attacker to retrieve arbitrary values from the wpoptions table, such as a list of active plugins. PoC List all active plugins of the...

CVE-2020-9629

Adobe DNG Software Development Kit SDK 1.5 and earlier versions have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure...

PT-2020-6322 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.3.4 and earlier Magento versions 2.2.11 and earlier Magento versions 1.14.4.4 and earlier Magento versions 1.9.4.4 and earlier Description: The issue is related to the lack of protection of the web page structure in Magento...

CVE-2020-4342

IBM Security Secret Server 10.7 could disclose sensitive information included in installation files to an unauthorized user. IBM X-Force ID: 178182...

The vulnerability of the oowriter text editor within the OpenOffice office suite arises from operations that occur outside the buffer boundaries of memory. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the oowriter text editor within the OpenOffice office suite is related to a memory management flaw after memory is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...

The vulnerability of the Lighttpd web server, related to integer overflows, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Lighttpd web server is related to a potential integer overflow. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions through malicious GET requests...

Curve: Sensitive Info Leak - An Attacker Can Retrieve All the Users Mobile Numbers at https://website-api.production.curve.app/api/waitlist/us

Hi, When am going through all the JS files in curve.com I found a link called "/usa" is used to create Curve USA Waitlists by entering your name, email address, mobile number and address details. F874173 Then there is a functionality called "Track my Position" by using which joined users can view...

The vulnerability of the GIFLZWDecompressor function in the OpenOffice office package allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the GIFLZWDecompressor function in the OpenOffice office package is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause...