MapPress Maps < 2.54.6 - Improper Capability Checks in AJAX Calls

Due to incomplete fixes for CVE-2020-12077, an attacker with subscriber privileges may be able to download, delete and upload arbitrary PHP files, which could result in remote command execution...

CVE-2020-13417

An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters...

CVE-2020-13417

An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters...

CVE-2020-13231

In Cacti before 1.2.11, authprofile.php?action=edit allows CSRF for an admin email change...

CVE-2020-10744

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....

CVE-2020-10744

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....

CVE-2020-10744

CVE-2020-10744 concerns a race condition in Ansible where an insecure temporary directory is created during become_user, enabling potential takeover of the become user. Connected documents confirm affected versions (Ansible Engine 2.7.18, 2.8.12, 2.9.9; Ansible Tower 3.4.5/3.5.6/3.6.4) and descri...

CVE-2020-10744

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....

CVE-2020-10744

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....

CVE-2020-3327

A vulnerability in the ARJ archive parsing module in Clam AntiVirus ClamAV Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit thi...

Denial Of Service (DoS)

memcached is vulnerable to denial of service DoS. The vulnerability exists as the tryreadcommand function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service segmentation fault via a request to add/set a key, which makes a comparison between signed and...

CVE-2020-9314

PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the...

Design/Logic Flaw

PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the...

CVE-2019-14898

CVE-2019-14898 refers to an incomplete fix for CVE-2019-11599 in the Linux kernel prior to 5.0.10. The issue allows a local attacker to trigger a race between mmget_not_zero() and get_task_mm(), which can lead to information disclosure, denial of service, or other unspecified impacts as described...

[SECURITY] [DSA 4676-2] salt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4676-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 07, 2020 https://www.debian.org/security/faq -...

F5 Networks BIG-IP : TMOS Shell vulnerability (K21711352)

Authenticated users granted TMOS Shell tmsh privileges can access objects on the file system, which would normally be disallowed by tmsh restrictions. This allows for authenticated, low privileged attackers to access objects on the file system, which would not normally be allowed. CVE-2019-19151...

Huawei EulerOS: Security Advisory for binutils (EulerOS-SA-2020-1548)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Potential denial of service in bson rubygem

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service worker resource consumption via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410...

Security Bulletin: IBM MQ Appliance could allow a local attacker to obtain sensitive information. (CVE-2020-4338)

Summary An incomplete fix for CVE-2019-4719 in the IBM MQ Appliance could still allow attackers to obtain sensitive information. Vulnerability Details CVEID: CVE-2020-4338 DESCRIPTION: IBM MQ 9.1.4 could allow a local attacker to obtain sensitive information by inclusion of sensitive data within...

Cross-Site Scripting (XSS)

markdown2 is vulnerable to cross-site scripting XSS attacks. The vulnerability is introduced by an incomplete fix to properly encode ampersands and angle brackets in the function encodeampsandangles,allowing an attacker to inject arbitrary Javascript into a victim's browser...