CVE-2020-26294

Vela compiler before version 0.6.1 allows exposure of server configuration via Sprig's env function in templates. The vulnerability affects the Vela server/component and enables an attacker to retrieve configuration information, exposing sensitive data. The issue has been fixed in version 0.6.1; ...

Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability

Severity Nokogiri maintainers have evaluated this as Low Severity CVSS3 2.6. Description In Nokogiri versions = 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. Th...

Cross-Site Scripting in scratch-svg-renderer

Overview This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function. Recommendation Upgrade to version...

Eclipse Jetty Privilege Escalation Vulnerability - Linux

Eclipse Jetty is prone to a privilege escalation vulnerability through a local temp directory. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2020-15251

In the Channelmgnt plug-in for Sopel a Python IRC bot before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2...

CVE-2020-15251

In the Channelmgnt plug-in for Sopel a Python IRC bot before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2...

Security feature bypass

In the Channelmgnt plug-in for Sopel a Python IRC bot before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2...

PYSEC-2020-110

In the Channelmgnt plug-in for Sopel a Python IRC bot before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2...

CVE-2020-15251 Privilege Escalation in Channelmgnt plug-in for Sopel

In the Channelmgnt plug-in for Sopel a Python IRC bot before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2...

CVE-2020-15251

CVE-2020-15251 affects the Channelmgnt plug‑in for Sopel prior to 1.0.3. The root cause is an ACL bypass that lets malicious users op/voice and take over a channel; the plug‑in is bundled with MirahezeBot‑Plugins (versions 9.0.0 through

CVE-2020-15251

In the Channelmgnt plug-in for Sopel a Python IRC bot before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2...

Cross-Site Scripting in ternary conditional operator

Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C5.0 CWE-79 --- :informationsource: This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020 --- Problem It has been discovered that the Fluid Engine package typo3fluid/fluid is...

Out of bounds access in tensorflow-lite

Impact In TensorFlow Lite models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor:...

Denial of Service in Tensorflow

Impact The RaggedCountSparseOutput does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the splits tensor has the minimum required number of elements. Code uses this quantity to initialize a different data structure:...

@anacoelhovicente/primecore (0.3.4-beta.1-webhook), @axonish/core (>=0.2.0, <=0.3.0) +29 more potentially affected by unknown CVE via type-graphql (>=0.12.3, <=0.17.5)

type-graphql NPM version =0.12.3, =0.2.0, =0.0.2, =1.0.0, =1.0.0, =0.0.5, =0.0.1, =0.0.0-487728, =0.1.0, =0.3.0-alpha.1, =0.0.1, =5.2.0, =0.0.1, =0.0.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XF64-2F9P-6PQQ...

@behance/istanbul (0.3.17-sourcemap), @bigcommerce/stencil-paper (>=2.0.15, <=2.0.25) +220 more potentially affected by unknown CVE via handlebars (>=3.0.0, <=3.0.7)

handlebars NPM version =3.0.0, =2.0.15, =0.4.0, =0.0.60-IE, =1.3.1, =1.0.4, =0.11.0, =0.0.1, =0.0.5, =0.0.6, =1.2.0, =0.1.0, =0.4.9 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q2C6-C6PM-G3GH...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1579 more potentially affected by unknown CVE via handlebars (>=4.0.0, <=4.5.2)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =0.0.2-next.4, =5.0.0-alpha.1, =6.0.10 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q2C6-C6PM-G3GH...

@behance/istanbul (0.3.17-sourcemap), @bigcommerce/stencil-paper (>=2.0.15, <=2.0.25) +220 more potentially affected by unknown CVE via handlebars (>=3.0.0, <=3.0.7)

handlebars NPM version =3.0.0, =2.0.15, =0.4.0, =0.0.60-IE, =1.3.1, =1.0.4, =0.11.0, =0.0.1, =0.0.5, =0.0.6, =1.2.0, =0.1.0, =0.4.9 and more Source cves: unknown CVE Source advisory: OSV:GHSA-2CF5-4W76-R9QV...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1573 more potentially affected by unknown CVE via handlebars (>=4.0.0, <=4.5.1)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =0.0.2-next.4, =5.0.0-alpha.1, =6.0.10 and more Source cves: unknown CVE Source advisory: OSV:GHSA-2CF5-4W76-R9QV...

@zowe/db2 (>=3.0.1-alpha.201904091134, <=3.0.2), @zowe/db2-for-zowe-cli (>=4.0.0, <=4.0.1) +4 more potentially affected by unknown CVE via ibm_db (>=2.0.0, <=2.5.0)

ibmdb NPM version =2.0.0, =3.0.1-alpha.201904091134, =4.0.0, =0.0.1, =7.0.0, =0.0.4, =0.0.5 - node-red-contrib-deebeetwoforzed 0.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-P77H-HV6G-FMFP...