ALPINE-CVE-2020-35680

smtpd/lkafilter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between th...

Raysync Remote Code Execution Vulnerability (CNVD-2020-73753)

Raysync is a cloud platform for storing and transferring large files. A remote code execution vulnerability exists in Raysync versions prior to 3.3.3.8. The vulnerability can be exploited to remotely execute code on a hosted server by sending a specially crafted request to overwrite a specific fi...

Tangro Business Workflow Code Issue Vulnerability

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A code issue vulnerability exists in tangro Business Workflow versions prior to 1.18.1, which stems from requesting a list of...

MediaWiki cross-site scripting vulnerability (CNVD-2020-74051)

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki versions prior to 1.35.1 that...

CVE-2018-1000893

Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when deserializing transactions...

Bitcoinsv Resource Management Error Vulnerability

Bitcoinsv is a software implementation of the original Bitcoin protocol by the Bitcoinsv Association. The software can be used to build Bitcoin infrastructure. A resource management error vulnerability exists in Bitcoin SV before 0.1.1 that stems from allowing uncontrolled resource consumption wh...

MediaWiki 跨站脚本漏洞

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. MediaWiki before 1.35.1 suffers from a cross-site scripting vulnerability tha...

Phoenix Contact PLCnext Control Devices 输入验证错误漏洞

Phoenix Contact PLCnext Control Devices is a programmable logic controller for industrial environments from Phoenix Contact. An input validation error vulnerability exists in Phoenix Contact PLCnext Control Devices prior to version 2021.0 LTS, which stems from a specially designed LLDP packet tha...

CVE-2020-35122

An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A malicious user could bypass the access controls for using a saved database connection profile to submit arbitrary SQL against a saved database connection...

keycloak: Account REST API can update user metadata attributes

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...

Bitdefender Antivirus Plus 访问控制错误漏洞

Bitdefender Antivirus Plus is a suite of antivirus software from the Romanian company Bitdefender that provides mainly cyber threat detection and ransomware protection. An access control error vulnerability exists in versions prior to Bitdefender Antivirus Plus 25.0.7.29, which stems from a sourc...

GNOME Glib Input Validation Error Vulnerability

GNOME GLib is a multi-platform toolkit for creating graphical user interfaces, and is the underlying core library that underlies GTK+ and GNOME projects. An input validation error vulnerability exists in GNOME GLib versions prior to 2.65.3, which stems from an integer overflow, which could result...

CVE-2020-29654

Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account...

CVE-2020-29563

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device...

UBUNTU-CVE-2020-7788

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

ASUS RT-AC88U Injection Vulnerability

The ASUS RT-AC88U is a wireless router from the Chinese company ASUS. An injection vulnerability exists in ASUS RT-AC88U Download Master versions prior to 3.1.0.108, which originates from MainLogin.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp without filtering user input. An attacke...

UBUNTU-CVE-2020-26957

OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox...

DEBIAN-CVE-2020-27758

A flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned long long. This would most likely lead to an impact to application availability, but...

UBUNTU-CVE-2020-27750

A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char and math division by zero. This would...

UBUNTU-CVE-2020-27772

A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned int. This would most likely lead to an impact to application availability, but could...