CVE-2020-16988

Azure Sphere Elevation of Privilege Vulnerability...

CVE-2020-16986

Azure Sphere Denial of Service Vulnerability...

CVE-2020-16981

Azure Sphere Elevation of Privilege Vulnerability...

CVE-2020-16984

Azure Sphere Unsigned Code Execution Vulnerability...

CVE-2020-27694

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 has updated a specific critical library that may vulnerable to attack...

Facebook WhatsApp for iOS logging library resource management error vulnerability

Facebook WhatsApp is a suite of mobile applications from the American company Facebook that utilize the web to deliver text messages. The application uses the contact information in a smartphone to find contacts using the software to send texts, pictures, etc. A security vulnerability exists in t...

Kaixin Electronic Document Inventory in Arbitrary File Download Vulnerability

Qixing electronic document library can be used to store departmental manuals, system specifications, mechanical drawings and other edoc. The Qixing Electronic Document Library is vulnerable to an arbitrary file download vulnerability, which can be exploited by an attacker to download any file on...

CVE-2020-24631

A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...

Web Cache Poisoning

Overview Affected versions of this package are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of the request between the proxy running with defaul...

UBUNTU-CVE-2020-26160

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with string for m"aud" which is allowed by the specification. Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lac...

USN-4560-1 ruby-gon vulnerability

It was discovered that Gon gem did not properly escape certain input. An attacker could use this vulnerability to execute a cross-site scripting XSS attack...

USN-4552-1 pam-python vulnerability

Malte Kraus discovered that Pam-python mishandled certain environment variables. A local attacker could potentially use this vulnerability to execute programs as root...

USN-4494-1 gupnp vulnerability

It was discovered that GUPnP incorrectly handled certain subscription requests. A remote attacker could possibly use this issue to exfiltrate data or use GUPnP to perform DDoS attacks...

UBUNTU-CVE-2020-14392

An untrusted pointer dereference flaw was found in Perl-DBI 1.643. A local attacker who is able to manipulate calls to dbddblogin6sv could cause memory corruption, affecting the service's availability...

CVE-2020-23656

NavigateCMS 2.9 is affected by Cross Site Scripting XSS on module "Content."...

CVE-2020-14522

Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled resource consumption, which may allow an attacker to cause a denial-of-service condition...

Denial of Service (DoS)

Overview github.com/russellhaering/goxmldsig is a XML Digital Signatures implemented in pure Go. Affected versions of this package are vulnerable to Denial of Service DoS. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. Details Denial of Service DoS describ...

CVE-2020-16237

Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly...

The vulnerability of the modular inversion function of the NSS libraries allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the modular inversion function in Network Security Services libraries is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that when processed by the glob function would potentially lead to arbitrary code execution. This was fixed in version 2.32.

...