PT-2020-6510 · Mobileiron · Mobileiron Sentry +3

Name of the Vulnerable Software and Affected Versions: MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 MobileIron Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0...

F5 NGINX Controller Authorization Issue Vulnerability (CNVD-2020-51553)

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. An authorization issue vulnerability exists in F5 NGINX Controller versions 3.0.0 through 3.4.0 in NGINX Controller...

thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data...

CVE-2020-6246

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXTTABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability...

freerdp: Out-of-bounds write in planar.c

A flaw was found in freerdp in versions between 1.0 and 2.0.0. An out-of-bounds memory write was found in the planar.c function which could allow an attacker to control data sent from the RDP server to the client. The highest threat from this vulnerability is to data confidentiality and integrity...

freerdp: Integer overflow in region.c

A flaw was found in FreeRDP in versions between 1.0 and 2.0.0. An integer overflow was found in the region.c function which could allow an attacker the ability to control the RDP server as well as the data sent to the client. The highest threat from this vulnerability is to data confidentiality a...

AEgir Information Disclosure Vulnerability (CNVD-2020-31168)

AEgir is a JavaScript project automation build package from Protocol Labs. An information disclosure vulnerability exists in aegir publish and aegir build in Aegir versions 21.7.0 through 21.10.1 excluding version 21.10.1. An attacker can use this vulnerability to obtain information about...

CVE-2020-4358

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 17876...

thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data...

NaviServer Denial of Service Vulnerability

NaviServer is a high-performance Web server written in C and Tcl. A denial of service vulnerability exists in NaviServer versions 4.99.4 through 4.99.19. The vulnerability stems from the nsd/driver.c ChunkedDecode function failing to properly validate the length of a chunk. A remote attacker coul...

DEBIAN-CVE-2020-11523

libfreerdp/gdi/region.c in FreeRDP versions 1.0 through 2.0.0-rc4 has an Integer Overflow...

UBUNTU-CVE-2020-11523

libfreerdp/gdi/region.c in FreeRDP versions 1.0 through 2.0.0-rc4 has an Integer Overflow...

IBM API Connect Information Disclosure Vulnerability (CNVD-2020-31096)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. An information disclosure vulnerability exists in the management server in IBM API Connect...

CVE-2020-10176

ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43p1 devices allow Eval Injection of commands...

WordPress Access Restriction Bypass Vulnerability (CNVD-2020-27079)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress versions 3.7 through 5.4, which stems from the fact that a passwo...

NetFortris Fonality Trixbox endpoint_devicemap.php Component OS Command Injection Vulnerability

NetFortris Fonality Trixbox is a suite of business telephony software from NetFortris USA. An operating system command injection vulnerability exists in the endpointdevicemap.php component in NetFortris Fonality Trixbox Community Edition versions 1.2.0 through 2.8.0.4, which can be exploited by a...

GitLab Cross-Site Scripting Vulnerability (CNVD-2020-27233)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in the Admin...

UBUNTU-CVE-2020-11020

Faye NPM, RubyGem versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It...

PT-2020-13089 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 9.5.9 through 12.9 Description: The issue concerns a stored XSS vulnerability in an admin notification feature. This allows for malicious code to be stored and executed when the notification is viewed by an administrator...

PT-2020-13090 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.8 through 12.9 Description: The issue allows someone to mirror a repository even if the feature is not activated. Recommendations: For GitLab versions 10.8 through 12.9, update to a version that contains a fix for this issu...