CVE-2020-0604: Undefined Security Weakness

A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with...

Visual Studio Code Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with...

PT-2020-3658

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description A remote code execution issue exists when Visual Studio Code processes environment variables after opening a project. An attacker who successfully exploits this could run arbitrary...

Canonical Ubuntu Point-to-Point Protocol Daemon Arbitrary File Read Information Disclosure Vulnerability

This vulnerability allows local attackers to read arbitrary files on affected installations of Canonical Ubuntu. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

Security Update for Microsoft Visual Studio Code Maven Extension (August 2020)

An input-validation flaw exists in Visual Studio Code Maven Extension related to processing environment variables after opening a project that allows remote code execution. An attacker can convince a user to clone a specified repository and to open it in Visual Studio Code leading to code...

USN-4442-1: Sympa vulnerabilities

Michael Kaczmarczik discovered that Sympa incorrectly handled HTTP GET/POST requests. An attacker could possibly use this issue to insert, edit or obtain sensitive information. CVE-2018-1000550 It was discovered that Sympa incorrectly handled URL parameters. An attacker could possibly use this...

USN-4442-1 sympa vulnerabilities

Michael Kaczmarczik discovered that Sympa incorrectly handled HTTP GET/POST requests. An attacker could possibly use this issue to insert, edit or obtain sensitive information. CVE-2018-1000550 It was discovered that Sympa incorrectly handled URL parameters. An attacker could possibly use this...

PT-2020-3584

Name of the Vulnerable Software and Affected Versions iOS versions prior to 13.6 iPadOS versions prior to 13.6 macOS Catalina versions prior to 10.15.6 Description An issue existed in the handling of environment variables, which has been addressed with improved validation. This issue may allow a...

openSUSE Security Update : singularity (openSUSE-2020-1037)

This update for singularity fixes the following issues : - New version 3.6.0. This version introduces a new signature format for SIF images, and changes to the signing / verification code to address the following security problems : - CVE-2020-13845, boo1174150 In Singularity 3.x versions below...

Debian DLA-2284-1 : ksh security update

A flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables cou...

openSUSE Security Update : singularity (openSUSE-2020-1011)

This update for singularity fixes the following issues : - New version 3.6.0. This version introduces a new signature format for SIF images, and changes to the signing / verification code to address the following security problems : - CVE-2020-13845, boo1174150 In Singularity 3.x versions below...

Security update for singularity (important)

openSUSE Security Update: Security update for singularity Announcement ID: openSUSE-SU-2020:1011-1 Rating: important References: 1174148 1174150 1174152 Cross-References: CVE-2020-13845 CVE-2020-13846 CVE-2020-13847 Affected Products: openSUSE Leap 15.2 An update that fixes three vulnerabilities ...

CVE-2020-15816

In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables...

CVE-2020-15816

In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables...

Code injection

In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables...

CVE-2020-15816

In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables...

CVE-2020-15816

CVE-2020-15816 affects Western Digital WD Discovery prior to version 4.0.251.0 . A malicious application running with standard user permissions could execute code within the WD Discovery process via library injection using DYLD environment variables . The vulnerability allows code execution in th...

CVE-2020-15816: Exposure of Resource to Wrong Sphere

In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables...

PT-2020-14645

Name of the Vulnerable Software and Affected Versions Western Digital WD Discovery versions prior to 4.0.251.0 Description A malicious application running with standard user permissions could potentially execute code in the WD Discovery application's process through library injection by using DYL...

Security Update for Microsoft Visual Studio Code ESLint Extension (July 2020)

An input-validation flaw exists in Visual Studio Code Live Share Extension related to handling source code validation upon project opening that allows remote code execution. An attacker can convince a user to clone a specified repository and to open it in Visual Studio Code leading to code...