Design/Logic Flaw

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to break out of its sandbox...

CVE-2020-10014

CVE-2020-10014 affects macOS components related to sandboxing controls, notably in libxpc/XPC, where a parsing/validation issue in directory paths could allow a sandbox escape. The fixed version is macOS Big Sur 11.0.1 (as per Apple HT211931), with related entries detailing memory/validation impr...

CVE-2020-10014

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to break out of its sandbox...

openSUSE Security Update : buildah (openSUSE-2020-2106)

This update for buildah fixes the following issues : buildah was updated to v1.17.0 bsc1165184 : - Handle cases where other tools mount/unmount containers - overlay.MountReadOnly: support RO overlay mounts - overlay: use fusermount for rootless umounts - overlay: fix umount - Switch default log...

Huawei HedEx Lite 200R006C00SPC005 - Path Traversal Vulnerability

Exploit Title: Huawei HedEx Lite 200R006C00SPC005 - Path Traversal Vendor Homepage: https://www.huawei.com/ Software Link: https://support.huawei.com/carrier/docview!docview?nid=SCL1000005027&path=PAN-ET/PAN-T/PAN-T-HedEx Version: 200R006C00SPC005 Product & Service Introduction:...

CVE-2020-13531: Use After Free

A use-after-free vulnerability exists in a way Pixar OpenUSD 20.08 processes reference paths textual USD files. A specially crafted file can trigger the reuse of a freed memory which can result in further memory corruption and arbitrary code execution. To trigger this vulnerability, the victim...

PT-2020-13607

Name of the Vulnerable Software and Affected Versions Pixar OpenUSD version 20.08 Description A use-after-free issue exists in the way Pixar OpenUSD processes reference paths in textual USD files. This can be triggered by a specially crafted file, leading to the reuse of freed memory, which may...

Authentication flaw

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths...

Vault Enterprise Prefixed Mount Policies May Result In Unauthorized Namespace Access

Summary A vulnerability was identified in Vault Enterprise such that, under certain circumstances, existing nested-path policies may give access to Namespaces created after-the-fact. This vulnerability, CVE-2020-10661, affects Vault Enterprise versions 0.11 and newer and is fixed in 1.3.4...

Vault Enterprise’s Dynamic Secrets May Persist After Namespace Deletion

Summary A vulnerability was identified in Vault Enterprise such that when deleting a namespace, in certain circumstances, the deletion process will fail to revoke dynamic secrets for a mount in that namespace. This vulnerability, CVE-2020-7220, affects Vault Enterprise 0.11.0 and newer and is fix...

Security update for rmt-server (important)

openSUSE Security Update: Security update for rmt-server Announcement ID: openSUSE-SU-2020:1993-1 Rating: important References: 1165548 1168554 1172177 1172182 1172184 1172186 1173351 Cross-References: CVE-2019-16770 CVE-2019-5418 CVE-2019-5419 CVE-2019-5420 CVE-2020-11076 CVE-2020-11077...

CVE-2020-13355

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: =8.14, =13.4, =13.5, 13.5.2...

CVE-2020-13355

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: =8.14, =13.4, =13.5, 13.5.2...

CVE-2020-13355: Improper Limitation of a Pathname to a Restricted Directory

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: =8.14, =13.4, =13.5, 13.5.2...

Advanced System Care Service 13 - 'AdvancedSystemCareService13' Unquoted Service Path

Title: Advanced System Care Service 13 - 'AdvancedSystemCareService13' Unquoted Service Path Author: Jair Amezcua Date: 2020-11-10 Vendor Homepage: https://www.iobit.com Software Link: https://www.iobit.com/es/advancedsystemcarepro.php Version : 13.0.0.157 Tested on: Windows 10 64bitEN CVE : N/A ...

CVE-2020-6149

A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance in USDC file format PATHS section...

CVE-2020-6149

A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance in USDC file format PATHS section...

CVE-2020-6149

A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance in USDC file format PATHS section...

PT-2020-18963

Name of the Vulnerable Software and Affected Versions Pixar OpenUSD version 20.05 Description A heap overflow issue exists when the software parses compressed sections in binary USD files. This can be triggered by opening a maliciously crafted file in the USDC file format PATHS section. The victi...

CVE-2020-6149: Heap-based Buffer Overflow

A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance in USDC file format PATHS section...