Critical Magento Flaws Allow Code Execution

Critical flaws in Adobe’s Magento e-commerce platform – which is commonly targeted by attackers like the Magecart cybergang – could enable arbitrary code execution on affected systems. Magento is a popular, Adobe-owned open-source e-commerce platform that powers many online shops. Adobe on Tuesda...

CVE-2020-9690

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

CVE-2020-9690

The CVE-2020-9690 observable timing discrepancy affects Magento/OpenMage LTS: OpenMage LTS before 19.4.6 and 20.0.2 allows bypass of fromkey protection in Admin Interface, increasing CSRF risk; patched in 19.4.6 and 20.0.2. Details are tied to Adobe’s CVE-2020-9690; exploitation status is not pro...

Node.js 12.x < 12.18.0, 14.x < 14.4.0 Host Certificate Verification Bypass Vulnerability - Mac OS X

Node.js is prone to a host certificate verification bypass. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js";...

Xiamen Creative Future Culture Co., Ltd.'s New Comic App Has Logic Flaw Vulnerability

New Manga is an internet platform that provides genuine and high-quality manga reading service, and owns an independent mobile manga reading tool - New Manga APP, which takes week as the basic unit and updates different works every day. Xiamen Creative Future Culture Co., Ltd. new comic APP there...

ALSA-2020:2852 Important: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 12.18.2. Security Fixes: nghttp2: overly large SETTINGS frames can lead to DoS...

CVE-2020-9588

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

CVE-2020-9588

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

CVE-2020-9588

Magento CTX: CVE-2020-9588 affects Magento 2.3.4 and earlier, 2.2.11 and earlier, 1.14.4.4 and earlier, and 1.9.4.4 and earlier. Description: an observable timing discrepancy vulnerability could allow signature verification bypass. The connected sources confirm the issue but do not specify exact ...

CVE-2020-13265

Removed by vendor...

PT-2020-13406 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.5 through 13.0.1 Description: The issue allows users to bypass email verification. Recommendations: For GitLab CE/EE versions 12.5 through 13.0.1, update to a version that contains a fix for this issue...

UBUNTU-CVE-2020-8172

TLS session reuse can lead to host certificate verification bypass in node version 12.18.0 and 14.4.0...

Design/Logic Flaw

TLS session reuse can lead to host certificate verification bypass in node version 12.18.0 and 14.4.0...

CVE-2020-8172

TLS session reuse can lead to host certificate verification bypass in node version 12.18.0 and 14.4.0...

Debian DLA-2234-1 : netqmail security update

There were several CVE bugs reported against src:netqmail. CVE-2005-1513 Integer overflow in the strallocreadyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code vi...

Foxit Reader and PhantomPDF Data Forgery Issue Vulnerability (CNVD-2020-32458)

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in Foxit Reader versions prior to 9.5 and PhantomPDF versions prior to 9.5. The vulnerability can be exploited to bypass signature verification with modified documents or...

Cisco IOS XE Software Digital Signature Verification Bypass (cisco-sa-iosxe-digsig-bypass-FYQ3bmVq)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability due to an improper check on the area of code that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by...

Foxit PhantomPDF Mac and Reader for Mac Data Forgery Issue Vulnerability

Foxit PhantomPDF Mac and Foxit Reader for Mac are both China Foxit Foxit company's a macOS-based PDF document reader. A security vulnerability exists in Foxit PhantomPDF Mac 3.4.0.1012 and earlier versions macOS and Foxit Reader 3.4.0.1012 and earlier versions macOS. An attacker can exploit the...

Foxit Reader and PhantomPDF Data Forgery Issue Vulnerability

Foxit PhantomPDF Mac and Foxit Reader for Mac are both China Foxit Foxit company's a macOS-based PDF document reader. A security vulnerability exists in Foxit Reader and PhantomPDF, which can be exploited by attackers to bypass signature verification through modified files or files with...

CVE-2020-3209 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...