kernel: af_packet: TPACKET_V3: invalid timer timeout on error

A flaw was found in the way the afpacket functionality in the Linux kernel handled the retirement timer setting for TPACKETv3 when getting settings from the underlying network device errors out. This flaw allows a local user who can open the afpacket domain socket and who can hit the error path, ...

OPENSUSE-SU-2020:1814-1 Security update for singularity

This update for singularity fixes the following issues: Update to new version 3.6.4: - CVE-2020-15229: Due to insecure handling of path traversal and the lack of path sanitization within unsquashfs, it is possible to overwrite/create files on the host filesystem during the extraction of a crafted...

OPENSUSE-SU-2020:1770-1 Security update for singularity

This update for singularity fixes the following issues: Update to new version 3.6.4: - CVE-2020-15229: Due to insecure handling of path traversal and the lack of path sanitization within unsquashfs, it is possible to overwrite/create files on the host filesystem during the extraction of a crafted...

PYSEC-2020-267

Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By...

PT-2020-16089

Name of the Vulnerable Software and Affected Versions CRMEB version 3.0 Description A SSRF issue exists in the downloadimage interface, allowing remote download of arbitrary files on the server and potentially enabling remote execution of arbitrary code. Recommendations For CRMEB version 3.0,...

CVE-2020-26902

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25...

Improper authorization due to caching in role-strategy

role-strategy 2.12 and newer uses a cache to speed up permission lookups. In role-strategy 3.0 and earlier this cache is not invalidated properly when an administrator changes the permission configuration. This can result in permissions being granted long after the configuration was changed to no...

UBUNTU-CVE-2020-11800

Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code...

OPENSUSE-SU-2020:1604-1 Security update for zabbix

This update for zabbix fixes the following issues: Updated to version 3.0.31. + CVE-2020-15803: Fixed an XSS in the URL Widget boo1174253...

PT-2020-16309 · Live Helper Chat · Livehelperchat

Name of the Vulnerable Software and Affected Versions: Live Helper Chat versions prior to 3.44v Description: The issue allows reflected XSS via the setsettingajax PATH INFO. This can potentially lead to malicious script execution. Recommendations: For versions prior to 3.44v, update to version...

CVE-2020-12506

Improper Authentication vulnerability in WAGO 750-8XX series with FW version = FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO...

freerdp: double free in update_read_cache_bitmap_v3_order function

In FreeRDP greater than 1.2 and before 2.0.0, a double free in updatereadcachebitmapv3order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0...

PT-2020-8929

Name of the Vulnerable Software and Affected Versions ANIXIS Password Reset Client versions prior to 3.22 Description The issue allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server...

CVE-2020-24029

Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "corrected in all maintained versions. Password reset requests are validated...

Oniguruma Resource Management Error Vulnerability

Oniguruma is an open source regular expression library. A resource management error vulnerability exists in Oniguruma versions prior to 6.9.3. The vulnerability stems from mismanagement of system resources e.g., memory, disk space, files, etc. by a networked system or product. No detailed...

Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in several products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Remote code execution Administrator/Root privileges Siemens...

Arbitrary File Deletion Vulnerability in Bludit CMS v3.13.0

Bludit CMS is a foreign multilingual lightweight website CMS system. Bludit CMS v3.13.0 has an arbitrary file deletion vulnerability that allows attackers to delete arbitrary zip files...

Fastify Resource Management Error Vulnerability

Fastify is an OpenJS Foundation open source web framework for Node.js. A resource management error vulnerability exists in Fastify versions v2.14.1 and v3.0.0-rc.4. An attacker can exploit this vulnerability to cause resource exhaustion denial of service...

IBM Security Key Lifecycle Manager Code Issue Vulnerability

IBM Security Key Lifecycle Manager Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A code issue vulnerability exists in IBM Security Key...