Kaixin Electronic Document Inventory in Arbitrary File Download Vulnerability

Qixing electronic document library can be used to store departmental manuals, system specifications, mechanical drawings and other edoc. The Qixing Electronic Document Library is vulnerable to an arbitrary file download vulnerability, which can be exploited by an attacker to download any file on...

CVE-2020-24631

A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...

Web Cache Poisoning

Overview Affected versions of this package are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of the request between the proxy running with defaul...

UBUNTU-CVE-2020-26160

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with string for m"aud" which is allowed by the specification. Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lac...

USN-4560-1 ruby-gon vulnerability

It was discovered that Gon gem did not properly escape certain input. An attacker could use this vulnerability to execute a cross-site scripting XSS attack...

USN-4552-1 pam-python vulnerability

Malte Kraus discovered that Pam-python mishandled certain environment variables. A local attacker could potentially use this vulnerability to execute programs as root...

USN-4494-1 gupnp vulnerability

It was discovered that GUPnP incorrectly handled certain subscription requests. A remote attacker could possibly use this issue to exfiltrate data or use GUPnP to perform DDoS attacks...

UBUNTU-CVE-2020-14392

An untrusted pointer dereference flaw was found in Perl-DBI 1.643. A local attacker who is able to manipulate calls to dbddblogin6sv could cause memory corruption, affecting the service's availability...

CVE-2020-23656

NavigateCMS 2.9 is affected by Cross Site Scripting XSS on module "Content."...

CVE-2020-14522

Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled resource consumption, which may allow an attacker to cause a denial-of-service condition...

Denial of Service (DoS)

Overview github.com/russellhaering/goxmldsig is a XML Digital Signatures implemented in pure Go. Affected versions of this package are vulnerable to Denial of Service DoS. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. Details Denial of Service DoS describ...

CVE-2020-16237

Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly...

The vulnerability of the modular inversion function of the NSS libraries allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the modular inversion function in Network Security Services libraries is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that when processed by the glob function would potentially lead to arbitrary code execution. This was fixed in version 2.32.

...

CVE-2020-17372

SugarCRM before 10.1.0 Q3 2020 allows XSS...

Code injection

An improperly initialized 'migrationAuth' value in Google's go-tpm TPM1.2 library versions prior to 0.3.0 can lead an eavesdropping attacker to discover the auth value for a key created with CreateWrapKey. An attacker listening in on the channel can collect both 'encUsageAuth' and...

USN-4447-1 libssh vulnerability

It was discovered that libssh incorrectly handled certain requests. An attacker could possibly use this issue to cause a denial of service...

GHSA-7PHR-5M9X-RW9Q Directory traversal in fast-http

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js...

TOBESOFT Nexacro14/17 ExtCommonApiV13 Library Input Validation Error Vulnerability

Tobesoft Nexacro is an OSMU Single Source Multipurpose application development solution based on a unified framework. An input validation error vulnerability exists in TOBESOFT Nexacro 14/17 ExtCommonApiV13 Library versions prior to 2019.9.6, which allows a remote attacker to execute arbitrary co...

Pillow Out-of-Bounds Read Vulnerability

Pillow is a Python based image processing library. An out-of-bounds read vulnerability exists in the processing of SGI image files in the libImaging/SgiRleDecode.c file in Pillow 7.0.0 and earlier versions. No detailed vulnerability details are provided at this time...