OPENSUSE-SU-2020:1243-1 Security update for postgresql12

This update for postgresql12 fixes the following issues: - update to 12.4: CVE-2020-14349, bsc1175193: Set a secure searchpath in logical replication walsenders and apply workers CVE-2020-14350, bsc1175194: Make contrib modules' installation scripts more secure...

Apple iTunes for Windows ImageIO Out-of-Bounds Write Vulnerability

Apple iTunes for Windows is a Windows-based media player application from Apple.ImageIO is one of the components that reads and writes image data. A security vulnerability exists in the ImageIO component in Apple iTunes for Windows versions prior to 12.10.8. The vulnerability can be exploited to...

PYSEC-2020-51

In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12...

CVE-2020-14064

IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts...

CVE-2020-14720

Vulnerability in the Oracle Internet Expenses product of Oracle E-Business Suite component: Mobile Expenses Admin Utilities. Supported versions that are affected are 12.2.4-12.2.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2020-14534

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Popups. The supported version that is affected is 12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2020-44270)

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. The software provides customer relationship management, service management, financial management and other functions. CRM Technical Foundation is one ...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2020-44278)

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in the Setup of Mobil...

GitLab path traversal vulnerability (CNVD-2020-29843)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise...

PT-2020-13088 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.6 through 12.9 Description: The issue allows an external user to create a personal snippet through the API, resulting in a privilege escalation. Recommendations: For GitLab versions 12.6 through 12.9, update to a version th...

vmware_escape

This is an exploit module for VMware Workstation prior to version 12.5.5. The exploit targets a vulnerability in the way VMware handles certain types of memory access, allowing an attacker to execute arbitrary code on the host system. The exploit is designed to be used by an attacker who has gain...

CVE-2017-18826

Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15,...

Oracle Supply Chain Products Suite Configurator Unauthorized Access Vulnerability

Oracle Supply Chain Products Suite is a set of supply chain solutions from Oracle. The product provides value chain planning, value chain execution, product lifecycle management and other functions. configurator is one of the integrated order management, quoting and sales configuration components...

CVE-2019-20649

NETGEAR MR1100 devices before 12.06.08.00 are affected by disclosure of sensitive information...

CVE-2020-2849

Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite component: Estimate and Actual Charges. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Depot...

PT-2020-5516 · Node.Js +7 · Node.Js +7

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to 12.19.1 Node.js versions prior to 14.15.1 Node.js versions prior to 15.2.1 Description: The issue is related to an uncontrolled resource consumption in Node.js, which can be exploited by a remote attacker to cause a...

GitLab Denial of Service Vulnerability (CNVD-2020-20425)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab version 12.9 an...

GitLab Domain Restriction Bypass Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab version 12.8.x...

PT-2020-20607 · Isomorphic · Smartclient

Name of the Vulnerable Software and Affected Versions: SmartClient version 12.0 Description: An issue was discovered in the Remote Procedure Call RPC loadFile provided by the console functionality. The issue affects the /tools/developerConsoleOperations.jsp or /isomorphic/IDACall URL, where...

GitLab EE Insecure Privilege Vulnerability (CNVD-2020-14342)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is GitLab Enterprise Edition. GitLab EE 12.2 suffers from an insecure privilege...