CVE-2020-17372

SugarCRM before 10.1.0 Q3 2020 allows XSS...

Code injection

An improperly initialized 'migrationAuth' value in Google's go-tpm TPM1.2 library versions prior to 0.3.0 can lead an eavesdropping attacker to discover the auth value for a key created with CreateWrapKey. An attacker listening in on the channel can collect both 'encUsageAuth' and...

USN-4447-1 libssh vulnerability

It was discovered that libssh incorrectly handled certain requests. An attacker could possibly use this issue to cause a denial of service...

GHSA-7PHR-5M9X-RW9Q Directory traversal in fast-http

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js...

TOBESOFT Nexacro14/17 ExtCommonApiV13 Library Input Validation Error Vulnerability

Tobesoft Nexacro is an OSMU Single Source Multipurpose application development solution based on a unified framework. An input validation error vulnerability exists in TOBESOFT Nexacro 14/17 ExtCommonApiV13 Library versions prior to 2019.9.6, which allows a remote attacker to execute arbitrary co...

Pillow Out-of-Bounds Read Vulnerability

Pillow is a Python based image processing library. An out-of-bounds read vulnerability exists in the processing of SGI image files in the libImaging/SgiRleDecode.c file in Pillow 7.0.0 and earlier versions. No detailed vulnerability details are provided at this time...

Command injection in mversion

Impact This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Patches Patched by version 2.0.0. Previous releases are deprecated in npm. Workarounds Make sure to escape git commit messages when using the commitMessage option for t...

PCRE Input Validation Error Vulnerability

PCRE is a Philip Hazel software developers of an open source regular expression library written in C language. An input validation error vulnerability exists in libpcre in versions of PCRE prior to 8.44. The vulnerability stems from a network system or product that does not properly validate inpu...

CVE-2020-7673

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument A of extend functionA,B,as,isAargs located within lib/extend.js is executed by the eval function, resulting in code execution...

CVE-2020-7661

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service...

CVE-2020-1799

E6878-370 with versions of 10.0.3.1H557SP27C233, 10.0.3.1H563SP1C00, 10.0.3.1H563SP1C233 has a use after free vulnerability. The software references memory after it has been freed in certain scenario, the attacker does a series of crafted operations through web portal, successful exploit could...

The vulnerability of the implementation library for the Transport Layer Security protocol of Cisco Firepower Threat Defense micro-programming software allows a attacker to compromise the integrity of the protected information.

The vulnerability of the Transport Layer Security protocol implementation library in Cisco Firepower Threat Defense software relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

USN-4360-1 json-c vulnerability

It was discovered that json-c incorrectly handled certain JSON files. An attacker could possibly use this issue to execute arbitrary code...

CVE-2020-12683

Katyshop2 before 2.12 has multiple stored XSS issues...

CVE-2019-5619

AASync.com AASync version 2.2.1.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow...

F5 Networks BIG-IP : Lodash library vulnerability (K47105354)

The version of F5 Networks BIG-IP installed on the remote host is prior to 12.1.5.2 / 13.1.3.4 / 13.1.3.5 / 14.1.2.5 / 14.1.2.7 / 15.0.1.4 / 15.1.0.5 / 15.1.1 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K47105354 advisory. - Versions of lodash lower than 4.17.12 a...

The vulnerability of the `gdImageCreateFromXbm` function in the GD graphics library for the PHP programming language allows a malicious actor to gain unauthorized access to sensitive information, due to a lack of mechanisms to verify the correctness of input data.

The vulnerability of the gdImageCreateFromXbm function in the GD graphics library for the PHP programming language is related to the lack of mechanisms for checking input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to sensitive information...

SUSE-SU-2020:0995-1 Security update for ruby2.5

This update for ruby2.5 to version 2.5.8 fixes the following issues: - CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON bsc1167244. - CVE-2020-10933: Heap exposure vulnerability in the socket library bsc1168938...

UBUNTU-CVE-2020-11758

An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h...

CVE-2020-7618

sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'...