CVE-2020-12502

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT all versions and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to...

Mozilla: Overriding file type when saving to disk

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR 78.1, Firefox...

CVE-2020-8219

An insufficient permission check vulnerability exists in Pulse Connect Secure 9.1R8 that allows an attacker to change the password of a full administrator...

AZL-6825 CVE-2019-20907 affecting package python2 for versions less than 2.7.18-8

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation...

CVE-2020-14095

In Xiaomi router R3600, ROM version1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or remote code execution...

CVE-2020-7639

eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload...

CVE-2020-7579

A vulnerability has been identified in Spectrum Power™ 5 All versions v5.50 HF02. The web server could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. If deployed according to...

AZL-9920 CVE-2019-20503 affecting package usrsctp for versions less than 0.9.5.0-1

usrsctp before 2019-12-20 has out-of-bounds reads in sctploadaddressesfrominit...

Error while downloding the Citrix Gateway Plugin from Downloads Tab of ADC : Forbidden you don't have permission to access

ADC version below 13.0 Error while downloading plugin: "Forbidden you don't have permission to access /vpns/scripts/mac/CitrixAccessGateway.dmg on this server"...

cPanel cross-site scripting vulnerability (CNVD-2019-30473)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the WHM MySQL Password Change interface in versions prior to cPanel 67.9999.103. T...

AZL-35341 CVE-2019-13232 affecting package unzip for versions less than 6.0-20

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a "better zip bomb" issue...

Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. A command injection vulnerability exists in Cisco Enterprise NFV...

Mozilla Firefox ESR Security Advisories (MFSA2019-04, MFSA2019-05) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

rubygem-rails-html-sanitizer: non-whitelisted attributes are present in sanitized output when input with specially-crafted HTML fragments leading to XSS vulnerability

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications...

CVE-2018-16490

A prototype pollution vulnerability was found in module mpath 0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype...

CVE-2018-16489

A prototype pollution vulnerability was found in just-extend 4.0.0 that allows attack to inject properties onto Object.prototype through its functions...

AZL-70997 CVE-2018-19827 affecting package reaper for versions less than 3.1.1-21

In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp or SharedPtr.hpp that may cause a denial of service application crash or possibly have unspecified other impact...

Design/Logic Flaw

embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

AZL-7277 CVE-2018-10393 affecting package libvorbis for versions less than 1.3.7-1

barknoisehybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read...

FreeXL heap buffer out-of-bounds read vulnerability (CNVD-2018-05154)

FreeXL is an open source library for extracting valid data from Excel .xls spreadsheets developed by software developer Alessandro Furieri. A heap buffer out-of-bounds read vulnerability exists in the 'parseSST' function in versions of FreeXL prior to 1.0.5. An attacker can exploit this...