CVE-2020-14002

PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts where no host key for the server has been cached by the client...

CVE-2020-13896

The CVE-2020-13896 entry documents an information-disclosure vulnerability in Maipu MP1800X-50 devices (firmware 7.5.3.14(R)) where the web interface exposes sensitive data via form/formDeviceVerGet. Connected sources (CNVD-2021-39048, CNVD-2019-02748) describe an information-disclosure flaw in t...

Multiple vulnerabilities in Cybozu Garoon

Overview Cybozu, Inc. has released security updates for Cybozu Garoon. CyVDB-2083 Vulnerability in Single sign-on settings to avoid viewing and operation privileges - CVE-2020-5580 CyVDB-2451 Path traversal vulnerability on the portal - CVE-2020-5581 CyVDB-2097 Vulnerability to bypass operation...

CVE-2020-14002

PuTTY versions 0.68–0.73 have an observable discrepancy during algorithm negotiation that can leak information and enable MITM targeting the initial connection when no host key is cached. This is documented across multiple sources (DEBIAN/Mageia/Fedora advisories and Nessus plugin references) wit...

8 U.S. City Websites Targeted in Magecart Attacks

Researchers are warning that the websites of eight U.S. cities – across three states – have been compromised with payment card-stealing Magecart skimmers. The websites all utilize Click2Gov municipality payment software, which was previously involved in data breaches. Unlike other skimmers, which...

CVE-2020-9557

Adobe Bridge is affected by CVE-2020-9557: in versions 10.x before 10.0.4, an out-of-bounds read could lead to information disclosure. The connected Nessus/Adobe advisories (APSB20-19) reference multiple vulnerabilities and indicate 10.0.4 as the fixed version. Practical impact is information dis...

Design/Logic Flaw

VMware ESXi 7.0 before ESXi7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG, Workstation 15.x before 15.5.2, and Fusion 11.x before 11.5.2 contain an information leak in the XHCI USB controller. A malicious actor with local access to a virtual machine may b...

PT-2020-14538 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax ftp...

Curve: Sensitive Info Leak - An Attacker Can Retrieve All the Users Mobile Numbers at https://website-api.production.curve.app/api/waitlist/us

Hi, When am going through all the JS files in curve.com I found a link called "/usa" is used to create Curve USA Waitlists by entering your name, email address, mobile number and address details. F874173 Then there is a functionality called "Track my Position" by using which joined users can view...

Debian: Security Advisory (DSA-4705-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[20200706] - Core - System Information screen could expose redis or proxy credentials

Inadequate filtering in the system information screen could expose redis or proxy credentials...

EulerOS 2.0 SP2 : unzip (EulerOS-SA-2020-1671)

According to the version of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a 'better zip...

CVE-2020-11841

CVE-2020-11841 affects Micro Focus ArcSight Management Center (ArcMC) across versions 2.6.1, 2.7.x, 2.8.x, and 2.9.x prior to 2.9.4. The vulnerability is an unauthorized information disclosure that can be exploited remotely, with a network attack vector and low complexity; authentication is requi...

CVE-2020-11840

CVE-2020-11840 affects Micro Focus ArcSight Management Center (ArcMC). Affected versions include 2.6.1, 2.7.x, 2.8.x, and 2.9.x prior to 2.9.4. The issue allows remote an unauthorized information disclosure. Remediation: upgrade to 2.9.4 or later (as indicated by “prior to 2.9.4”). If upgrading i...

jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the c3p0 gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS ...

unzip: overlapping of files in ZIP container leads to denial of service

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a "better zip bomb" issue...

PT-2020-8504 · Adns +2 · Adns +2

Name of the Vulnerable Software and Affected Versions: adns versions prior to 1.5.2 Description: An issue was discovered in adns where adns rr info mishandles a bogus datap. The general pattern for formatting integers is to sprintf into a fixed-size buffer, which can be overrun if the input is ou...

CVE-2020-4045

SSB-DB 20.0.0 contains an information-disclosure vulnerability in the get() method that can decrypt any decryptable message and return private data. The issue affects peers with private messages, and exploitation is tied to SSB-OOO (default in SSB-Server), which exposes a wrapper around get() to ...

CVE-2020-0134

In BnDrm::onTransact of IDrm.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID:...

CVE-2020-0212

In onBufferDestroyed of InputBufferManager.cpp, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android...