CVE-2020-26954

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on...

PT-2020-19565 · Mcafee · Mcafee Database Security Server/Sensor

Name of the Vulnerable Software and Affected Versions: McAfee Database Security Server and Sensor versions prior to 4.8.0 Description: The issue is related to the use of a broken or risky cryptographic algorithm in the form of a SHA1 signed certificate. This could allow an attacker on the same...

ImageMagick Studio ImageMagick 安全漏洞

Imagemagick Studio ImageMagick is a suite of open source image processing software from ImageMagick Studio Imagemagick Studio, an American company. The software can read, convert or write images in many formats. A memory leak vulnerability exists in the MIFF coder in versions of ImageMagick prior...

UBUNTU-CVE-2020-8563

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects v1.19.3...

ImageMagick Studio ImageMagick 输入验证错误漏洞

ImageMagick is a software for creating, editing, and composing images that can read, convert, and write images in many formats. ImageMagick Input Validation Error Vulnerability, coders/bmp.c in versions of ImageMagick prior to 7.0.9-0, exists outside the range of representable values of type...

CVE-2020-6880

A ZXELINK wireless controller has a SQL injection vulnerability. A remote attacker does not need to log in. By sending malicious SQL statements, because the device does not properly filter parameters, successful use can obtain management rights. This affects: ZXV10 W908 all versions before...

Mozilla: Fullscreen could be enabled without displaying the security UI

It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...

B&r Automation APROL SQL Injection Vulnerability

B&r Automation APROL is a Linux-based process control system for industrial control applications from B&r Automation Australia. A SQL injection vulnerability exists in versions prior to B&R Industrial Automation APROL R4.2 V7.08, which makes EnMon PHP scripts susceptible to SQL injection attacks...

BigBlueButton 安全漏洞

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A conference access code brute force attack vulnerability exists in BigBlueButton 2.2.29 and earlier versions. The vulnerability stems from the ability to enter an unlimited amount of code for a conference...

Cloudera Data Engineering 跨站请求伪造漏洞

Cloudera Data Engineering is a service-less architecture cloud service from Cloudera, Inc. that supports the creation of Apache Spark tasks on a cloud platform. A cross-site request forgery vulnerability exists in Cloudera Data Engineering versions prior to 1.1, which stems from vulnerability to...

CVE-2020-14190

Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4...

Apache Unomi 注入漏洞

Apache Unomi is a java open source client data platform that can be used on multiple systems to manage user profiles and the data associated with that profile, Unomi was announced as a top Apache project in 2019. Since Apache Unomi is built as an OSGi application running in Apache Karaf, it is...

DEBIAN-CVE-2020-25660

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the...

Broadcom CA Unified Infrastructure Management 安全漏洞

CA Unified Infrastructure Management is a powerful unified IT monitoring solution that helps organizations deliver reliable, flexible IT services. An elevation of privilege vulnerability exists in the controller component in CA Unified Infrastructure Management 20.1 and earlier versions, which ca...

PDFResurrect 缓冲区错误漏洞

PDFResurrect is a tool for analyzing PDF documents to help extract old "hidden" versions of pdf from the current pdf. pdfgetversion in versions prior to PDFResurrect 0.20 has a heap buffer overflow vulnerability. . The vulnerability stems from a lack of header validation checks in PDFResurrect. N...

CVE-2020-28951

libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uciparsepackage in file.c and ucistrdup in util.c...

BigBlueButton 安全漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. versions prior to BigBlueButton 2.2.29 have a security vulnerability that could be exploited by an attacker to cast multiple votes in a single poll...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, an American company. A post-release reuse vulnerability exists in WebRTC in versions prior to Google Chrome 87.0.4280.66. A remote attacker can exploit heap corruption via a crafted HTML page...

Google Chrome Information Disclosure Vulnerability (CNVD-2020-65186)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in graphics in Google Chrome versions prior to 87.0.4280.66. A remote attacker can exploit this vulnerability to obtain sensitive information...

Google Chrome 跨站脚本漏洞

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 87.0.4280.66. An attacker can exploit this vulnerability to bypass security restrictions...