GHSA-7WW4-C3MJ-93CF Downloads Resources over HTTP in pm2-kafka

Affected versions of pm2-kafka insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syst...

CVE-2020-7669

This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction...

CVE-2020-7666

The CVE-2020-7666 entry concerns github.com/u-root/u-root/pkg/cpio, where the cpio extraction code is vulnerable to path traversal (leading and non-leading relative paths) and symlink-based traversal (relative and absolute) during archive extraction. Multiple sources describe this as Arbitrary Fi...

CVE-2020-7725

All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function...

CVE-2020-7722

All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function...

CVE-2020-7718

All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions...

CVE-2020-7715

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function...

Design/Logic Flaw

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function...

CVE-2020-7724

CVE-2020-7724 affects the tiny-conf package: prototype pollution via the set function. Affected versions are all up to and including 1.1.0; no fixed version is available. Documents describe the vulnerability as enabling property pollution on Object.prototype, with potential DoS or broader impact,...

CVE-2020-7715 Prototype Pollution

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function...

CVE-2020-7711

This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

MGASA-2020-0341 Updated chrony package fixes security vulnerability

Chrony's method of opening its PID file could allow a compromised chrony user account to overwrite files in certain parts of the filesystem with chrony's PID, using a symlink attack CVE-2020-14367...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

Command injection

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

Design/Logic Flaw

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function...

Code injection

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution...

CVE-2020-7694

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

CVE-2020-7687

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js...

CVE-2020-15123 Command injection in codecov (npm package)

In codecov npm package before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE CVE-2020-7597 for GHSA-5q88-cjfq-g2mh was...

openSUSE: Security Advisory for python-ipaddress (openSUSE-SU-2020:1002-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...