UBUNTU-CVE-2020-11800

Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code...

PYSEC-2020-307

In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to dlpack.todlpack there is a memory leak following an expected validation failure. The issue occurs because the status argument during validation failures is not properly checked. Since each of the above methods ca...

accuinsight (>=1.0.47 <=1.0.61), alphad3m (>=0.10.0 <=0.10.0.dev1) +82 more potentially affected by CVE-2020-15206 via tensorflow (=2.2.0)

tensorflow PYPI version =2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - accuinsight =1.0.47, =0.10.0, =0.5.0, =0.2.0, =0.0.6, =1.2.0, =1.0.0, =0.0.15, =0.0.16 and more Source cves: CVE-2020-15206 Source advisory...

GHSA-8FXW-76PX-3RXV Memory leak in Tensorflow

Impact If a user passes a list of strings to dlpack.todlpack there is a memory leak following an expected validation failure: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.ccL100-L104 The allocated memory is from...

PT-2020-15584

Name of the Vulnerable Software and Affected Versions: xxl-job version 2.2.0 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the AppName and AddressList parameters in the...

In libexpat in Expat before 2.2.7 XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).

...

Zephyr Code Execution Vulnerability (CNVD-2020-35962)

Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. A security vulnerability exists in the MQTT packet length decoder in Zephyr 2.2.0 and later versions fixed in version 2.3.0. An attacker could exploit this vulnerability to cause memory corruption and...

Zephyr Input Validation Error Vulnerability (CNVD-2020-35963)

Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. An input validation error vulnerability exists in Zephyr version 2.2.0 and later fixed in version 2.3.0. An attacker can exploit this vulnerability to cause a denial of service with arbitrary CoAP...

CVE-2020-10063

A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions...

PT-2020-5464

Name of the Vulnerable Software and Affected Versions Django versions 2.2 before 2.2.13 Django versions 3.0 before 3.0.7 Description An issue in the Django admin ForeignKeyRawIdWidget allows for a possibility of an XSS attack due to query parameters not being properly URL encoded. This could enab...

Ruby JSON gem input validation error vulnerability

Ruby JSON gem is a Ruby-based package for parsing JSON from text and generating JSON text from Ruby objects. An input validation error vulnerability in Ruby JSON gem version 2.2.0 and earlier can be exploited to force the creation of arbitrary objects on a target system...

Western Digital My Cloud Home and ibi Websites Clickjacking Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud Home and ibi Websites versions prior to 2.2.0. An attacker could exploit the vulnerability to hijack click-through actions on the login page...

Cisco Identity Services Engine Access Control Error Vulnerability (CNVD-2020-03719)

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An access control error...

CloudBees Jenkins SCTMExecutor Plugin Credential Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . A credential disclosure vulnerability exists in CloudBees Jenkins SCTMExecutor Plugin 2.2 and prior versions, which originates when the program passes encrypted...

DEBIAN-CVE-2019-16396

GnuCOBOL 2.2 has a use-after-free in the endscopeofprogramname function in cobc/parser.y via crafted COBOL source code...

Magento Station Request Forgery Vulnerability

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A cross-site request forgery vulnerability exists in Magento versions 2.1.18 before 2.1, 2.2.9 before 2.2.2 and...

Magento cross-site scripting vulnerability (CNVD-2019-26231)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A cross-site scripting vulnerability exists in Magento version 2.1.18 before version 2.1, 2.2.9 before version 2....

GnuCOBOL Buffer Overflow Vulnerability

GnuCOBOL is a COBOL language compiler. A buffer overflow vulnerability exists in 'cbevaluateexpr' in the cobc/field.c file in GnuCOBOL version 2.2, which can be exploited by an attacker to cause a buffer overflow or heap overflow...

WordPress WebAppick WooCommerce Product Feed Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WebAppick WooCommerce Product Feed is a plugin used in WordPress to generate product feed data. A cross-site scripting...

CVE-2019-10183

Virt-install1 utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced...