CVE-2020-4928

IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention, the attacker could execute arbitrary code on the server. IBM X-Force ID: 191705...

CVE-2020-4908

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This information could be used in further attacks against the system...

EUVD-2020-9080

Microsoft Excel Remote Code Execution Vulnerability...

CVE-2020-29576

The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password...

[SECURITY] Fedora 33 Update: pam-1.4.0-9.fc33

PAM Pluggable Authentication Modules is a system security tool that allows system administrators to set authentication policy without having to recompile programs that handle authentication...

CVE-2020-26548

Aviatrix Controller (pre-R5.4.1290) contains an insecure sudo rule that allows a user to execute any command as any user on the system. This vulnerability affects Controller versions before R5.4.1290 and is supported by multiple sources (e.g., CNVD-2021-17716; NVD CVE-2020-26548) with high impact...

icsmaster

This repository is an offensive tool for ICS Industrial Control Systems security research. It contains a collection of resources, including papers, exploits, firmware, Nmap scripts, and tools, related to ICS security. The repository is organized into several sections, including a directory of...

SUSE-SU-2020:3256-1 Security update for u-boot

This update for u-boot fixes the following issues: Fix CVE-2019-13106 bsc1144656, CVE-2019-13104 bsc1144675, CVE-2019-14192 bsc1143777, CVE-2019-14193 bsc1143817, CVE-2019-14199 bsc1143824, CVE-2019-14197 bsc1143821, CVE-2019-14200 bsc1143825, CVE-2019-14201 bsc1143827, CVE-2019-14202 bsc1143828,...

Important: Red Hat Security Advisory: xorg-x11-server security update

An update for xorg-x11-server is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

scap-security-guide bug fix and enhancement update

The scap-security-guide project provides a guide for configuration of the system from the final system's security point of view. The guidance is specified in the Security Content Automation Protocol SCAP format and constitutes a catalog of practical hardening advice, linked to government...

CVE-2020-28045

CVE-2020-28045 affects ProlinOS up to 2.4.161.8859R. Root cause: shared libraries are not required to be signed and are not verified, allowing an attacker with local access to load a crafted shared object via LD_PRELOAD, bypassing kernel ELF verification and executing unsigned code. This creates ...

CVE-2019-8832

CVE-2019-8832 is a memory corruption vulnerability in Apple platforms. The issue could allow an application to execute arbitrary code with system privileges. It affects multiple Apple operating systems, with fixes in iOS 13.3, iPadOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2, Security Update 20...

Fieldcomm Group HART-IP and hipserver

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Fieldcomm Group Equipment: HARP-IP Developer kit, hipserver Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the device being...

The vulnerability of the OLYMPOX educational control system’s web application, which arises from the failure to protect the structure of the web page, allows a hacker to inject arbitrary code.

The vulnerability of the OLYMPOX educational control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely...

webkitgtk: Multiple memory corruption issues leading to arbitrary code execution

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2020-26110

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces SEC-564...

toaca.md Cross Site Scripting vulnerability OBB-1352132

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Malicious Package in test-module-a

All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. If you own any...

Unauthorized File Access in atompm

Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system. Recommendation Upgrade to version 0.8.2 or later...

Microsoft Windows/Windows Server Information Disclosure Vulnerability (CNVD-2021-63311)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. Microsoft Windows/Windows Server is vulnerable to an information disclosure vulnerability that originates...