PT-2020-19853 · Mongodb +1 · Mongodb Server +2

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 4.5.1 MongoDB Server versions 4.4 prior to 4.4.1 MongoDB Server versions 4.2 prior to 4.2.9 MongoDB Server versions 4.0 prior to 4.0.20 MongoDB Server versions 3.6 prior to 3.6.20 Description: A user authorize...

CVE-2020-8897

CVE-2020-8897 : A weak robustness vulnerability affects the AWS Encryption SDKs for Java, Python, C and Javalcript prior to 2.0.0. The non-committing property of AES-GCM (and related AEAD ciphers) can let an attacker craft a unique ciphertext that decrypts to multiple different results, which is ...

PT-2020-16834 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.0.1 Description: A path handling issue was addressed with improved validation, allowing a remote attacker to potentially modify the file system. Recommendations: For versions prior to 11.0.1, update to macOS Big Sur...

PT-2020-6242 · Apache +9 · Apache Http Server +9

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.0 through 2.4.46 Description: The issue is caused by a stack overflow in the mod auth digest function of the Apache HTTP Server. This can be triggered by a specially crafted Digest nonce. Although there are no...

HPESBHF04047 rev.2 - HPE OneView and Synergy Composer, Remote Escalation of Privilege

Potential Security Impact: Remote: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Synergy Composer 5.0, 5.00.01, 5.00.02, 5.2, 5.20.01, 5.3, 5.4 - Earlier versions are also impacted. But, they are not supported. HPE Synergy Composer 2 5.0, 5.00.01,...

PT-2020-8661 · Qnap Systems · Photo Station

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Photo Station versions prior to 5.7.11 QNAP Systems Inc. Photo Station versions prior to 6.0.10 Description: The issue is a cross-site scripting vulnerability that could allow remote attackers to inject malicious code if...

PT-2020-16747 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-2 Description: The issue makes it easier for remote attackers to capture session cookies by intercepting their transmission within an HTTP session, as the Secure flag is not set f...

PT-2020-12895 · Micro Focus · Hp Universal Cmdb +6

Name of the Vulnerable Software and Affected Versions: Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.6x, 10.1x and older versions Application Performance Management versions 9.51, 9.50, 9.40 with uCMDB 10.33 CUP 3 Data Center Automation version 2019.11 Operatio...

PT-2020-4929 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Description: A vulnerability in the SSL/TLS handler could allow an unauthenticated, remote attacker to cause the affected device to reload unexpectedly, leading to...

PT-2020-6180 · FFmpeg +5 · Ffmpeg +5

Name of the Vulnerable Software and Affected Versions: FFmpeg version 4.3.1 Description: The issue is related to the decode frame function in the libavcodec/exr.c component, which has an out-of-bounds write due to errors in calculations. This can be exploited by a remote attacker to cause a denia...

PT-2020-14887 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS Evolved versions prior to 20.1R2-EVO Description: The issue occurs when parsing a specifically malformed NDP packet sent from the local area network to a device running Juniper Networks Junos OS Evolved, causing the...

openMAINT 1.1-2.4.2 - Arbitrary File Upload

Exploit Title: openMAINT 1.1-2.4.2 - Arbitrary File Upload Dork: N/A Date: 2020-08-19 Exploit Author: mrb3n Vendor Homepage: https://www.openmaint.org/en Software Link: https://sourceforge.net/projects/openmaint/files/1.1/openmaint-1.1-2.4.2.zip/download Version: 1.1-2.4.2 Category: Webapps Teste...

PT-2020-17528 · Rust · Ws

Name of the Vulnerable Software and Affected Versions: ws crate versions prior to 2020-09-25 Description: An issue in the ws crate allows a remote memory-consumption attack due to the outgoing buffer not being properly limited. This enables a remote attacker to take down the process by growing th...

PT-2020-16022 · Yworks · Yed Desktop

Name of the Vulnerable Software and Affected Versions: yWorks yEd Desktop versions prior to 3.20.1 Description: The issue allows XXE attacks via an XML or GraphML document. Recommendations: For versions prior to 3.20.1, update to version 3.20.1 or later to resolve the issue...

The `size` option isn't honored after following a redirect in node-fetch

Impact Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relyin...

PT-2020-11886 · Unknown · License Management Utility

Name of the Vulnerable Software and Affected Versions: License Management Utility LMU versions prior to V2.4 Description: A security issue has been identified where the lmgrd service of the affected application runs with local SYSTEM privileges on the server, and its configuration can be modified...

PT-2020-16216

Name of the Vulnerable Software and Affected Versions sized-chunks crate versions through 0.6.2 Description An issue in the sized-chunks crate for Rust can lead to memory-safety problems. Specifically, in the Chunk implementation, the array size is not checked when constructed with unit, pair, or...

PT-2020-15741

Name of the Vulnerable Software and Affected Versions voidtools Everything versions prior to 1.4.1 Beta Nightly 2020-08-18 Description The issue allows privilege escalation via a Trojan horse urlmon.dll file in the installation directory. This is only relevant if low-privileged users can write to...

PT-2020-5563 · Artifex +7 · Ghostscript +7

Name of the Vulnerable Software and Affected Versions: Artifex Software GhostScript versions 9.50 Description: The issue is related to a buffer overflow in the lprn is black function, located in contrib/lips4/gdevlprn.c, which can be exploited by a remote attacker to cause a denial of service. Th...

PT-2020-6943 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions prior to 4.0.8 Redmine versions 4.1.x prior to 4.1.2 Description: The issue is related to permission handling errors in the Redmine project and task management web application. Exploitation of this issue allows a remote...