3389 matches found
CVE-2020-35711
An issue has been discovered in the arc-swap crate before 0.4.8 and 1.x before 1.1.0 for Rust. Use of arcswap::access::Map with the Constant test helper or with a user-supplied implementation of the Access trait could sometimes lead to dangling references being returned by the map...
PT-2020-5496 · Packwood · Mpxj
Name of the Vulnerable Software and Affected Versions: Packwood MPXJ versions prior to 8.3.5 Description: The issue exists due to incorrect restriction of the directory path name in the common/InputStreamHelper.java library of MPXJ, allowing a remote attacker to write files to arbitrary locations...
RUSTSEC-2020-0091 Dangling reference in `access::Map` with Constant
Using the arcswap::access::Map with the Constant test helper or with user-provided implementation of the Access trait could sometimes lead to the map returning dangling references. Replaced by implementation without unsafe, at the cost of added Clone bound on the closure and small penalty on...
Unbreakable Enterprise kernel security update
2.6.39-400.328.1 - crypto: authenc - fix parsing key with misaligned rtalen Eric Biggers Orabug: 31535531 CVE-2020-10769 - crypto: authenc - Export key parsing helper function Mathias Krause Orabug: 31535531 CVE-2020-10769...
NewStart CGSL CORE 5.04 / MAIN 5.04 : git Multiple Vulnerabilities (NS-SA-2020-0075)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has git packages installed that are affected by multiple vulnerabilities: - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug...
NewStart CGSL CORE 5.05 / MAIN 5.05 : git Multiple Vulnerabilities (NS-SA-2020-0113)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has git packages installed that are affected by multiple vulnerabilities: - An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clone...
Unbreakable Enterprise kernel security update
kernel-uek 3.8.13-118.52.1 - crypto: authenc - fix parsing key with misaligned rtalen Eric Biggers Orabug: 31535530 CVE-2020-10769 - crypto: authenc - Export key parsing helper function Mathias Krause Orabug: 31535530 CVE-2020-10769...
@servable/server (>=1.0.0 <=1.11.2), dockertools (=1.8.2) +5 more potentially affected by CVE-2020-7785 via node-ps (=0.0.2)
node-ps NPM version =0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on node-ps and may be impacted: - @servable/server =1.0.0, =1.0.0, =1.5.1, =0.2.1, =0.0.3, =0.0.4 - servable-publishable =1.1.0 Source cves: CVE-2020-7785 Source advisory:...
Vault SSH Helper Validated IP Addresses Incorrectly
Summary vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host’s network interface was located, rather than the specific IP address assigned to that interface. Assigned CVE-2020-24359 and fixed in 0.1.7. Background...
nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution
A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to arbitrary code execution. The package lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript into the system. This issue is used to...
OSV-2020-2180 UNKNOWN READ in helper_be_stl_mmu_armeb
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27736 Crash type: UNKNOWN READ Crash state: helperbestlmmuarmeb stack...
GHSA-HPJM-3WW5-6CPF Cross-Site Scripting through Fluid view helper arguments
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 5.7 CWE-79 Problem Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS throug maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML...
CVE-2020-27192
BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code into ForkLift. This would allow the attacker to run malicious code with escalated privileges through ForkLift's helper tool...
CVE-2020-27192
BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code into ForkLift. This would allow the attacker to run malicious code with escalated privileges through ForkLift's helper tool...
CVE-2020-15349
BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows file operations to any process copy, move, delete as root and changing permissions...
CVE-2020-27192
BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code into ForkLift. This would allow the attacker to run malicious code with escalated privileges through ForkLift's helper tool...
Cross-Site Scripting through Fluid view helper arguments
Three XSS vulnerabilities have been detected in Fluid:...
TYPO3 跨站脚本漏洞
TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Typo3 Association. TYPO3 suffers from a cross-site scripting vulnerability that originates from insufficient processing of user-supplied data in the system extension Fluid typo3 / cms-fluid when...
Cross-Site Scripting through Fluid view helper arguments
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-009...
Binarynights Forklift Code Injection Vulnerability
Binarynights Forklift is a file resource management software from the American company Binarynights. The software references the FINDER file manager and directly manages FTP/SFTP/WebDAV, Amazon S3, iDisk, BLUETOOH and other resources. A security vulnerability exists in BinaryNights ForkLift versi...