Examples for Developers - Critical - Remote Code Execution - SA-CONTRIB-2020-035

The File Example submodule within the Examples project does not properly sanitize certain filenames as described in SA-CORE-2020-012, along with other related vulnerabilities. Therefore, File Example so is being removed from Examples until a version demonstrating file security best practices can...

TYPO3 跨站脚本漏洞

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. TYPO3 Fluid suffers from a cross-site scripting vulnerability, no detailed vulnerability details are provided at this time...

openGauss: Configuring the Client Log Message Level

The parameter clientminmessages specifies the level of messages to be sent to the client. The valid values include DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1, LOG, NOTICE, WARNING, ERROR, FATAL, and PANIC. It must be NOTICE at least. After a level is selected, messages at this level and its lower...

openGauss: Configuring the Level of Error-Deriving SQL Statements to Be Logged

The logminerrorstatement parameter specifies which level of SQL statements that cause an error will be recorded into server logs. SQL statements whose levels are higher than or equal to the configured level will be recorded into server logs. The valid values include DEBUG5, DEBUG4, DEBUG3, DEBUG2...

Intel® Falcon 8+ UAS AscTec Thermal Viewer Advisory

Summary: A potential security vulnerability in the Intel® Falcon 8+ UAS AscTec Thermal Viewer may allow escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation Notice for the Intel® Falcon 8+ UAS AscTec Thermal...

CVE-2017-17378

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...

CVE-2020-14294

An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board...

Design/Logic Flaw

An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board...

CVE-2020-14294

An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board...

CVE-2020-14294: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board...

PT-2020-13961

Name of the Vulnerable Software and Affected Versions Secudos Qiata FTA version 1.70.19 Description An issue was discovered that allows persistent XSS, which is executed when reading transfer comments or the global notice board, due to a flaw in the comment feature. Recommendations For Secudos...

Twitter Warns Developers of API Bug That Exposed App Keys, Tokens

Twitter developers are being warned of a security bug that may have exposed their applications’ credential information – including sensitive application keys and access tokens. The issue stemmed from a caching issue in developer.twitter.com. When developers visited this website, it temporarily...

Exploit for OS Command Injection in Secudos Domos

CVE-2020-14293 This vulnerablity was discovered and disclosed...

Exploit for Path Traversal in Inneo Startup_Tools

CVE-2020-15492 This vulnerablity was discovered and disclosed...

LSN-0071-1 Kernel Live Patch Security Notice

Or Cohen discovered that the AFPACKET implementation in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2020-14386...

Multiple vulnerabilities fixed in Ghostscript

Several vulnerabilities have been fixed in Ghostscript. The vulnerabilities allow a remote malicious party to cause a denial-of-service, or potentially execute arbitrary code execute with the privileges of the process calling Ghostscript. -= Ubuntu =- Canonical has made updates available for Ubun...

GHSA-M45F-4828-5CV5 Regular Expression Denial of Service in highcharts

Withdrawn: Duplicate of GHSA-xmc8-cjfr-phx3...

Intel® Mailbox Interface Driver Advisory

Summary: A potential security vulnerability in the Intel® Mailbox Interface driver may allow escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation Notice for the Intel® Mailbox Interface driver. Vulnerability...

CA Unified Infrastructure Management Nimsoft 7.80 Buffer Overflow Exploit

This Metasploit module exploits a buffer overflow within the CA Unified Infrastructure Management nimcontroller. The vulnerability occurs in the robot controller component when sending a specially crafted directorylist probe. Technically speaking the target host must also be vulnerable to...

CA Unified Infrastructure Management Nimsoft 7.80 Buffer Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CA Unified Infrastructure Management Nimsoft 7.80 - Remote Buffer Overflow', 'Description' = %q This module exploits a buffer overflow within the...