CVE-2019-18618

Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash all versions prior to 2019-11-15 allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table...

The vulnerability of the config_file() function in the procps-ng command-line utility allows a hacker to escalate their privileges.

The vulnerability of the configfile function in the procps-ng command-line utility is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious individual to increase their privileges...

BlogCMS Cross-Site Request Forgery Vulnerability

BlogCMS is a PHP and MySQL based blogging system by Pramod Mahato Software Developers in India. A cross-site request forgery vulnerability exists in the admin/changepass.php file in BlogCMS 2019-12-31 and earlier versions. The vulnerability stems from the WEB application not adequately verifying...

Acronis: Account Takeover on unverified emails in File Sync & Share

Summary The name change functionality in File Sync & Share is expected to change the name in File Sync & Share. But the API endpoint used in it also allows changing email to any email without having to verify the email. The login email stays the same but the email within File Sync & Share...

CVE-2020-13276

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1...

CVE-2020-13272

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...

CVE-2020-13276

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1...

Authorization

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...

UBUNTU-CVE-2020-13276

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1...

Design/Logic Flaw

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

CVE-2020-13275

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

CVE-2020-13272

Removed by vendor...

CVE-2020-13272

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...

CVE-2020-13276

Removed by vendor...

PT-2020-13416 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.2 through 13.0.1 Description: A user with an unverified email address could request access to domain-restricted groups. Recommendations: For GitLab EE versions 12.2 through 13.0.1, update to a version that contains a fix...

PT-2020-13413 · Oauth +1 · Oauth +1

Name of the Vulnerable Software and Affected Versions: OAuth versions 12.3 through 13.0.1 Description: The issue concerns the OAuth flow missing verification checks, allowing an unverified user to use the OAuth authorization code flow. Recommendations: For versions 12.3 through 13.0.1, update to ...

PT-2020-13417 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 13.0.1 Description: The issue allows a user to set an email as a notification email without verifying the new email. Recommendations: For versions prior to 13.0.1, update to version 13.0.1 or later to resolve th...

CVE-2019-14042

Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

Huawei Honor V20 Information Disclosure Vulnerability (CNVD-2020-27123)

Huawei Honor V20 is a smartphone from Chinese company Huawei Huawei. An information disclosure vulnerability exists in Huawei Honor V20 versions prior to 10.0.0.179 C636E3R4P3, prior to 10.0.0.180 C185E3R3P3, and prior to 10.0.0.180 C432E10R3P4, which stems from a program that does not adequately...

Denial Of Service (DoS)

samba is vulnerable to denial of service. The application does not verify device name and mountpoint strings, allowing local users to crash the application via a malicious string...