Huawei P30 Pro Buffer Overflow Vulnerability (CNVD-2020-48584)

Huawei P30 Pro is a smartphone from Chinese company Huawei Huawei. A buffer overflow vulnerability exists in a module in versions prior to Huawei P30 Pro 10.1.0.160 C00E160R2P8, which stems from a function of the module missing a specific checksum when processing messages sent by other modules. A...

Parallels Desktop Elevation of Privilege Vulnerability

Parallels Desktop is a virtual machine software that runs on Mac computers. A lift-limit vulnerability exists in the HOSTIOCTLSETKERNELSYMBOLS handler in prlhypervisor kext in versions prior to Parallels Desktop 16.0.0 48916. The vulnerability stems from a lack of proper validation of user-suppli...

McAfee Data Loss Prevention Endpoint for Mac Credential Protection Vulnerability

McAfee Data Loss Prevention Endpoint DLPe is an integrated endpoint data protection solution from McAfee. The solution prevents theft and accidental disclosure of confidential data and provides security policies for file handling and transmission, shared endpoint data flow control and data...

Parallels Desktop Out-of-Bounds Read Information Disclosure Vulnerability (CNVD-2020-46860)

Parallels Desktop is a virtual machine software that runs on Mac computers. An out-of-bounds read information disclosure vulnerability exists in prlhypervisor kext in versions prior to Parallels Desktop 16.0.0 48916. The vulnerability stems from a lack of proper validation of user-supplied data. ...

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir NULL NULL) and files using g_file_replace_contents (kfsb->file contents length NULL FALSE G_FILE_CREATE_REPLACE_DESTINATION NULL NULL NULL). Consequently it does not properly restrict directory (and file) permissions. Instead for directories 0777 permissions are used; for files default file permissions are used. This is similar to CVE-2019-12450.

...

jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Dovecot Out-of-Bounds Read Vulnerability

Dovecot is an open source based on Linux/UNIX-like systems IMAP and POP3 mail server . A security vulnerability exists in Dovecot versions prior to 2.3.11.3. An attacker can exploit this vulnerability to cause the authentication service to crash...

SugarCRM Cross-Site Scripting Vulnerability (CNVD-2020-46296)

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A cross-site...

AZL-6926 CVE-2020-24331 affecting package trousers for versions less than 0.3.14-7

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file which contains various settings related to this daemon...

CVE-2020-8714

Improper authentication for some IntelR Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-7301

Cross Site scripting vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section...

Micro Focus Secure Messaging Gateway Injection Vulnerability

Micro Focus Secure Messaging Gateway SMG is a secure messaging gateway product from Micro Focus UK. The product supports features such as email scanning and inbound and outbound protection. A security vulnerability exists in Micro Focus SMG versions prior to 2020-7. An attacker could exploit the...

MyBB Cross-Site Scripting Vulnerability (CNVD-2020-46844)

MyBB MyBulletinBoard is a free and Web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB versions prior to 1.8.24. The vulnerability stems...

JetBrains YouTrack Server-Side Request Forgery Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A server-side request forgery vulnerability exists in versions prior to JetBrains YouTrack...

DP3T-Backend-SDK Data Forgery Issue Vulnerability

DP3T-Backend-SDK is a backend implementation of DP3T Decentralized Privacy Preserving Neighborhood Tracking. A security vulnerability exists in DP3T-Backend-SDK versions prior to 1.1.1. An attacker can exploit the vulnerability to bypass signature checking...

Contour Access Control Error Vulnerability

Contour is a Kubernetes entry controller that uses the Envoy agent. An Access Control Error vulnerability exists in versions prior to Contour 1.7.0. The vulnerability stems from a network system or product not properly restricting access to resources from unauthorized roles. No detailed...

October CMS Information Disclosure Vulnerability

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. An information disclosure vulnerability exists in versions of October CMS prior to 1.0.468 that stems from the program not binding an encrypted cookie value to the cookie name of that...

jackson-databind: Serialization gadgets in javax.swing.JEditorPane

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality...

slpjs Input Validation Error Vulnerability

slpjs is a JavaScript library for validating and building the Simple Ledger Protocol SLP. An input validation error vulnerability exists in versions of slpjs prior to 0.21.4. The vulnerability stems from a network system or product that does not properly validate input data...

Google Chrome Code Execution Vulnerability (CNVD-2020-49886)

Google Chrome is a web browser from Google, Inc.SCTP is one of the Stream Control Transmission Protocols SCTP. A security vulnerability exists in SCTP in versions prior to Google Chrome 84.0.4147.105. An attacker can exploit the vulnerability to execute arbitrary code with the help of specially...