MyBB Cross-Site Scripting Vulnerability (CNVD-2020-46844)

MyBB MyBulletinBoard is a free and Web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB versions prior to 1.8.24. The vulnerability stems...

JetBrains YouTrack Server-Side Request Forgery Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A server-side request forgery vulnerability exists in versions prior to JetBrains YouTrack...

DP3T-Backend-SDK Data Forgery Issue Vulnerability

DP3T-Backend-SDK is a backend implementation of DP3T Decentralized Privacy Preserving Neighborhood Tracking. A security vulnerability exists in DP3T-Backend-SDK versions prior to 1.1.1. An attacker can exploit the vulnerability to bypass signature checking...

Contour Access Control Error Vulnerability

Contour is a Kubernetes entry controller that uses the Envoy agent. An Access Control Error vulnerability exists in versions prior to Contour 1.7.0. The vulnerability stems from a network system or product not properly restricting access to resources from unauthorized roles. No detailed...

October CMS Information Disclosure Vulnerability

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. An information disclosure vulnerability exists in versions of October CMS prior to 1.0.468 that stems from the program not binding an encrypted cookie value to the cookie name of that...

jackson-databind: Serialization gadgets in javax.swing.JEditorPane

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality...

slpjs Input Validation Error Vulnerability

slpjs is a JavaScript library for validating and building the Simple Ledger Protocol SLP. An input validation error vulnerability exists in versions of slpjs prior to 0.21.4. The vulnerability stems from a network system or product that does not properly validate input data...

Google Chrome Code Execution Vulnerability (CNVD-2020-49886)

Google Chrome is a web browser from Google, Inc.SCTP is one of the Stream Control Transmission Protocols SCTP. A security vulnerability exists in SCTP in versions prior to Google Chrome 84.0.4147.105. An attacker can exploit the vulnerability to execute arbitrary code with the help of specially...

DEBIAN-CVE-2020-6511

Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2020-14618

Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Mobile App. The supported version that is affected is Prior to 20.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Primavera Unifier...

CVE-2020-13923

IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04...

Google Chrome CSP Policy Bypass Vulnerability

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A CSP policy bypass vulnerability exists in versions prior to Google Chrome 84.0.4147.89, no detailed vulnerability details are available at this time...

Bitcoin wxBitcoin/bitcoind Denial of Service Vulnerability

A vulnerability exists in Bitcoin wxBitcoin and bitcoind versions prior to 0.3.5. A remote attacker could use this vulnerability to cause a denial of service daemon crash via a Bitcoin transaction containing the OPLSHIFT script opcode...

sane-backends: Heap buffer overflow in esci2_img

A flaw was found in sane-backends in versions prior to 1.0.30. A heap buffer overflow in the esci2img function could lead to a remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2020-12426

Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 78...

CVE-2020-12404

For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS 26...

CMSUno Cross-Site Request Forgery Vulnerability

CMSUno is a tool for creating single-page responsive websites by French software developer Jacques Malgrange. A cross-site request forgery vulnerability exists in versions of CMSUno prior to 1.6.1. The vulnerability stems from a WEB application that does not adequately validate that a request is...

CVE-2020-15573

SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421...

McAfee Total Protection Elevation of Privilege Vulnerability (CNVD-2020-53310)

McAfee Total Protection MTP is a suite of antivirus software from the American company McAfee. An elevation of privilege vulnerability exists in versions prior to McAfee MTP 16.0.R26, which can be exploited by a local attacker to unauthoritatively delete files via a malicious script or program...

Cisco Digital Network Architecture Center Information Disclosure Vulnerability (CNVD-2020-45582)

Cisco Digital Network Architecture Center DNA Center is a set of digital network architecture solutions from the U.S. company Cisco Cisco. The program can extend and protect devices, applications, etc. within the network. An information disclosure vulnerability exists in Cisco DNA Center versions...