FasterXML jackson-databind code issue vulnerability (CNVD-2020-53534)

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A security vulnerability exists in FasterXML jackson-databind version 2.x prior to 2.9.10.5. No detailed vulnerability details are provided at...

DEBIAN-CVE-2020-13965

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview...

DEBIAN-CVE-2020-12803

ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need f...

Unspecified Vulnerability in Facade Ignition for Laravel

Facade Ignition for Laravel is a customizable error page from Facade Belgium that runs in the Laravel web framework. A security vulnerability exists in Facade Ignition versions prior to 2.0.5 Laravel, which stems from the program not handling global variables get, post, cookie and env correctly. ...

Foxit Reader Code Problem Vulnerability

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A code issue vulnerability exists in Foxit Reader versions prior to 2.4.4. The vulnerability stems from a design or implementation problem in the code development process of a networked system or product. An attacker could...

Unspecified vulnerability in Google Chrome permissions

Google Chrome is a web browser from Google, Inc. permissions is one of the permissions components. A security vulnerability exists in permissions in Google Chrome versions prior to 80.0.3987.87, which can be exploited by remote attackers to spoof a secure user interface with the help of specially...

Unspecified Vulnerability in Google Chrome CSP

Google Chrome is a web browser from Google, Inc.CSP is a content security policy plugin. A security vulnerability exists in CSP in versions of Google Chrome prior to 80.0.3987.87, which stems from the program's failure to adequately enforce policies, and can be exploited by a remote attacker to...

Joomla! cross-site scripting vulnerability (CNVD-2020-53800)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A cross-site scripting vulnerability exists in versions of Joomla! prior to 3.9.19, which stems from a default setting in the global text filter...

PT-2020-13661 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.19 Description: The issue is related to missing token checks in the com postinstall component, which leads to Cross-Site Request Forgery CSRF. CSRF is an attack where an attacker tricks a user into performing...

Apple macOS Catalina Find My Component Input Validation Error Vulnerability

Apple macOS Catalina is a proprietary operating system developed by Apple Inc. for Mac computers.Find My is one of the components that supports tracking the location of Apple devices. A security vulnerability exists in the Find My component in Apple macOS Catalina versions prior to 10.15.5. A loc...

CVE-2020-7808

In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update moduleweb.js allows an attacker to modify arguments which causes downloading a random DLL and injection on it...

UBUNTU-CVE-2020-6483

Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

Dolibarr ERP/CRM Cross-Site Scripting Vulnerability (CNVD-2020-33669)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in Dolibarr ERP/CR...

jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Opto 22 SoftPAC Project Authorization Issues Vulnerability

Opto 22 SoftPAC Project is an automation software suite from Opto 22 USA. The product is capable of providing industrial automation, process control, building automation, remote monitoring, data acquisition and industrial IoT. An authorization issue vulnerability exists in Opto 22 SoftPAC Project...

CVE-2020-12876

Veritas APTARE versions prior to 10.4 allowed remote users to access several unintended files on the server. This vulnerability only impacts Windows server deployments...

PT-2020-5402 · Freerdp +6 · Freerdp +6

Name of the Vulnerable Software and Affected Versions: FreeRDP versions prior to 2.1.0 Description: The issue is related to an out-of-bound read in irp functions, specifically in parallel process irp create, serial process irp create, drive process irp write, printer process irp write, rdpei recv...

CVE-2020-12006

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control...

Dell EMC RSA Archer Injection Vulnerability

Dell EMC RSA Archer is an enterprise IT governance and compliance governance product from Dell USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. An injection vulnerability exists in versions prior to Dell EMC RSA Arche...

libreoffice: Remote resources protection module not applied to bullet graphics

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed...