Huawei Data Communication: CPU Side Channel Vulnerability L1TF (huawei-sa-20180815-01-cpu)

Intel and security researchers publicly disclosed three new cpu side-channel vulnerabilities CVE-2018-3615, CVE-2018-3620 and CVE-2018-3646. This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from ...

Schneider Electric EcoStruxure Operator Terminal Expert Path Traversal Vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A path traversal vulnerability exists in Schneider Electric EcoStruxure Operator...

Schneider Electric EcoStruxure Operator Terminal Expert Parameter Injection Vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A parameter injection vulnerability exists in Schneider Electric EcoStruxure Operator...

CVE-2020-1171

A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on wi...

Schneider Electric EcoStruxure Operator Terminal Expert

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Low skill level to exploit/public exploits are available Vendor: Schneider Electric Equipment: EcoStruxure Operator Terminal Expert Vulnerabilities: SQL Injection, Path Traversal, Argument Injection 2. RISK EVALUATION Successful exploitation of these...

CVE-2020-1171: Undefined Security Weakness

A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on wi...

CVE-2020-11807

Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code and sometimes terminal commands on a server by making an avatar update and then visiting the avatar file under the /images/ path...

Unrestricted file upload

Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code and sometimes terminal commands on a server by making an avatar update and then visiting the avatar file under the /images/ path...

PT-2020-12860

Name of the Vulnerable Software and Affected Versions Sourcefabric Newscoop version 4.4.7 Description The issue allows an authenticated user to execute arbitrary PHP code, and sometimes terminal commands, on a server. This is achieved by making an avatar update and then visiting the avatar file...

CVE-2020-11807: Unrestricted Upload of File with Dangerous Type

Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code and sometimes terminal commands on a server by making an avatar update and then visiting the avatar file under the /images/ path...

Schneider Electric EcoStruxure Operator Terminal Expert SQL Injection Vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A SQL injection vulnerability exists in the handling of VXDZ files in Schneider Electr...

Schneider Electric EcoStruxure Operator Terminal Expert Path Traversal Vulnerability (CNVD-2020-37620)

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A path traversal vulnerability exists in the processing of ZIP files in Schneider...

Schneider Electric EcoStruxure Operator Terminal Expert Path Traversal Vulnerability (CNVD-2020-37619)

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A path traversal vulnerability exists in the handling of VXDZ files in Schneider...

SecureCRT Memory Corruption

securecrt: memory corruption in CSI functions CVE-2020-12651 I noticed a vulnerability in SecureCRT that allows a remote system to corrupt memory in the terminal process and execute arbitrary code. The bug is that if you specify a line number to CSI functions that exceeds INTMAX, the unsigned...

Security Update for Microsoft Visual Studio Code Python Extension (May 2020)

A remote code execution RCE vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged o...

PT-2020-19610

Name of the Vulnerable Software and Affected Versions EcoStruxure Operator Terminal Expert versions 3.1 Service Pack 1 and prior Description A path traversal issue exists during zip file extraction, potentially allowing unauthorized write access outside the expected path folder when opening a...

Schneider Electric EcoStruxure Operator Terminal Expert VXDZ File Parsing Directory Traversal Remote Code Execution Vulnerability

The vulnerablity allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Operator Terminal Expert. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific...

PT-2020-19609

Name of the Vulnerable Software and Affected Versions EcoStruxure Operator Terminal Expert versions 3.1 Service Pack 1 and prior Description A path traversal issue exists, which could lead to malicious code execution when opening a project file. This is due to improper limitation of a pathname to...

USN-4345-1: Linux kernel vulnerabilities | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description Al Viro discovered that the Linux kernel for s390x systems did not properly perform page table upgrades for kernel sections that use secondary address mode. A local attacker could use this to cause a denial...

PT-2020-2730

Name of the Vulnerable Software and Affected Versions EcoStruxure Operator Terminal Expert versions 3.1 Service Pack 1 and prior Description The issue is related to improper handling of VXDZ files and a SQL Injection vulnerability, which could allow an attacker to execute arbitrary code using a...