8090 matches found
Extended Keys Not Appearing When Selecting "Keyboard" Button in Desktop Viewer - Citrix Workspace App for iOS
When using a Smart Keyboard, unable to display extended keys when selecting the "Keyboard" option on Citrix Workspace App for iOS on iOS 12.x devices...
PT-2021-2650
Name of the Vulnerable Software and Affected Versions FreeBSD versions 12.1-STABLE before r365010 FreeBSD versions 11.4-STABLE before r365011 FreeBSD versions 12.1-RELEASE before p9 FreeBSD versions 11.4-RELEASE before p3 FreeBSD versions 11.3-RELEASE before p13 Description The issue is related t...
September 1, 2020, update for Office 2016 (KB4484395)
None None...
PT-2020-21592
Name of the Vulnerable Software and Affected Versions samsung-remote versions prior to 1.3.5 Description The issue allows for command injection and is exploitable when user input is passed into the ip option of the package constructor. Recommendations Update to version 1.3.5 or later...
PT-2020-15872 · Gnupg +1 · Gnupg Kleopatra +1
Name of the Vulnerable Software and Affected Versions: GnuPG Kleopatra versions prior to 3.1.12 GnuPG Kleopatra versions prior to 20.07.80 Description: The issue allows remote attackers to execute arbitrary code due to the unsafe handling of command-line options when supporting openpgp4fpr: URLs...
CVE-2020-24714
The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verifyhostname option...
Exploit for CVE-2020-1938
It is an exploit module for CNVD-2020-10487 CVE-2020-1938, a file read vulnerability in Tomcat AJP. The vulnerability allows an attacker to read files on the server by sending a specially crafted AJP request. The exploit is implemented in Python 2.7 and uses the ajpy library to interact with the...
CVE-2020-15498
An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.38520253. The router accepts an arbitrary server certificate for a firmware update. The culprit is the --no-check-certificate option passed to wget tool used to download firmware update files...
CVE-2020-13101
In OASIS Digital Signature Services DSS 1.0, an attacker can control the validation outcome i.e., trigger either a valid or invalid outcome for a valid or invalid signature via a crafted XML signature, when the InlineXML option is used. This defeats the expectation of non-repudiation...
PT-2020-13334 · Oasis · Oasis Digital Signature Services
Name of the Vulnerable Software and Affected Versions: OASIS Digital Signature Services DSS version 1.0 Description: The issue allows an attacker to control the validation outcome of a signature via a crafted XML signature when the InlineXML option is used, defeating the expectation of...
VulnCheck KEV: CVE-2019-6703
Incorrect access control in miglaajaxfunctions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call...
USN-4466-2 curl vulnerability
USN-4466-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Marc Aldorasi discovered that curl incorrectly handled the libcurl CURLOPTCONNECTONLY option. This could result in data being sent to the wrong destination,...
USN-4466-1 curl vulnerability
Marc Aldorasi discovered that curl incorrectly handled the libcurl CURLOPTCONNECTONLY option. This could result in data being sent to the wrong destination, possibly exposing sensitive information...
wrong connect-only connection
An application that performs multiple requests with libcurl's multi API and sets the CURLOPTCONNECTONLY option, might in rare circumstances experience that when subsequently using the setup connect-only transfer, libcurl picks and uses the wrong connection - and instead picks another one the...
CURL-CVE-2020-8231 wrong connect-only connection
An application that performs multiple requests with libcurl's multi API and sets the CURLOPTCONNECTONLY option, might in rare circumstances experience that when subsequently using the setup connect-only transfer, libcurl picks and uses the wrong connection - and instead picks another one the...
MGASA-2020-0328 Updated firejail packages fix security vulnerability
It was reported that firejail does not respect the end-of-options separator "--", allowing an attacker with control over the command line options of the sandboxed application, to write data to a specified file CVE-2020-17367. It was reported that firejail when redirecting output via --output or...
Info-ZIP Zip 3.0 when the -T and -TT command-line options are used allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value given that the entire purpose of -TT is execution of arbitrary commands
...
An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific in readelf.c via a malformed MIPS option section.
...