CVE-2020-27898

CVE-2020-27898 is an Apple macOS vulnerability where a denial of service was addressed through improved state handling, and there is a potential to bypass Managed Frame Protection. The issue is fixed in macOS Big Sur 11.0.1. Public references indicate this CVE is associated with the Wi‑Fi compone...

CVE-2020-27898: Unchecked Return Value

A denial of service issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1. An attacker may be able to bypass Managed Frame Protection...

c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in blosc_run_decompression_with_context

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5131542452109312 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

Clickjacking

WebUI is vulnerable to clickjacking. The vulnerability existed when the X-Frame-Options header is not set...

Out-of-Bounds Read

LuaJit is vulnerable to out-of-bounds read. This vulnerability existed because the gc handler frame traversal is mishandled...

CVE-2020-25464

Heap buffer overflow at moddable/xs/sources/xsDebug.c in Moddable SDK before before 20200903. The top stack frame is only partially initialized because the stack overflowed while creating the frame. This leads to a crash in the code sending the stack frame to the debugger...

Heap overflow

Heap buffer overflow at moddable/xs/sources/xsDebug.c in Moddable SDK before before 20200903. The top stack frame is only partially initialized because the stack overflowed while creating the frame. This leads to a crash in the code sending the stack frame to the debugger...

CVE-2020-25464

Heap buffer overflow at moddable/xs/sources/xsDebug.c in Moddable SDK before before 20200903. The top stack frame is only partially initialized because the stack overflowed while creating the frame. This leads to a crash in the code sending the stack frame to the debugger...

Moddable SDK Buffer Error Vulnerability

Moddable SDK is a set of software development kits SDKs for embedded software development for the Internet of Things from Moddable, Inc. in the United States. A buffer error vulnerability exists in versions prior to Moddable SDK 20200903, which stems from a moddable/xs/sources/xsDebug.c heap buff...

USN-4658-1 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities

It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2020-0423 Daniele Antonioli, Nils Ole...

CVE-2020-5679

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted...

USN-4660-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities

It was discovered that a race condition existed in the perf subsystem of the Linux kernel, leading to a use-after-free vulnerability. An attacker with access to the perf subsystem could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2020-14351 It was...

USN-4657-1 linux, linux-aws, linux-azure, linux-kvm, linux-lts-trusty, linux-raspi2, linux-snapdragon vulnerabilities

Elena Petrova discovered that the pin controller device tree implementation in the Linux kernel did not properly handle string references. A local attacker could use this to expose sensitive information kernel memory. CVE-2020-0427 Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-4658-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4658-1 advisory. It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel, leading to a use-after-free...

Gorilla Websocket Resource Management Error Vulnerability

Gorilla Websocket is a Go-based implementation of the Websocket codebase by the individual developers of Gorilla. A resource management error vulnerability exists in Gorilla WebSocket versions prior to 1.4.0, which stems from an integer overflow vulnerability in the length of a websocket frame...

Prototype Pollution

nunjucks is vulnerable to prototype pollution. The attacker is able to get control of value of this.variables in Frame.prototype.lookup and modify attributes such as proto, constructor and prototype...

PT-2020-22153

Name of the Vulnerable Software and Affected Versions blosc2 affected versions not specified Description The issue is related to a heap-buffer-overflow read. Technical details about the crash include the frame get usermeta function, blosc2 frame to schunk function, and blosc2 schunk open sframe...

c-blosc2:decompress_frame_fuzzer: Crash in blosc_getitem

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=6325402909540352 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerubsanc-blosc2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

Nextcloud: Clickjacking URLS

Hey Team While performing security testing of your websites i have found the vulnerability called Clickjacking. Many URLS are in scope and vulnerable to Clickjacking. The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The...

RHEL 7 : firefox (RHSA-2020:4080)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4080 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...