PT-2020-14257 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 2.16.11 Helm versions prior to 3.3.2 Description: The issue arises from improper sanitization of plugin names, allowing a malicious plugin author to use characters that could result in unexpected behavior. This could...

mysql: Server: Connection Handling unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Connection Handling. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2020-8339

A cross-site scripting inclusion XSSI vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module AMM web interface prior to version 3.68n BPET68N. This vulnerability could allow an authenticated user's AMM credentials to be disclosed if the user is convinced to visit a...

PT-2020-5371 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.8.13 Description: The issue is related to incorrect cryptographic signature verification in the Linux kernel. This could allow an attacker to impact the confidentiality, integrity, and availability of protecte...

UBUNTU-CVE-2020-13306

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation...

UBUNTU-CVE-2020-13312

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a specific parameter...

UBUNTU-CVE-2020-13289

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activated...

Kentico Cross-Site Scripting Vulnerability (CNVD-2020-52038)

Kentico is the United States Kentico company's set of ASP.NET-based content management system CMS. A cross-site scripting vulnerability exists in Kentico prior to version 12.0.75, which stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this...

CVE-2020-2042

A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue impacts only PAN-OS 10.0 versions earlier than PAN-OS 10.0.1...

CVE-2020-2038

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlie...

wildfly-elytron: session fixation when using FORM authentication

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

Atlassian Confluence XSS Vulnerability

Atlassian Confluence is a suite of specialized enterprise knowledge management and collaboration software from Atlassian Australia that can also be used to build enterprise WiKi. An XSS vulnerability exists in the table filters and charts in the Confluence Server app, versions prior to 5.3.26,...

PT-2020-19738 · Deeps · Deeps

Name of the Vulnerable Software and Affected Versions: deeps versions prior to 1.4.6 Description: The issue concerns Prototype Pollution via the set function. This allows for potential manipulation of object properties, which could lead to various security issues. Recommendations: For versions...

CVE-2020-10518

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the...

PYSEC-2020-252

The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName...

jenkins: Stored XSS vulnerability in 'keep forever' badge icons

A flaw was found in jenkins in versions prior to 2.244 and versions prior to LTS 2.235.1. Job names in the 'Keep this build forever' badge tooltip are not properly escaped which results in a stored cross-site scripting XSS vulnerability exploitable by users able to configure job names. The highes...

Google Chrome Security Bypass Vulnerability (CNVD-2020-49912)

Google Chrome is a web browser. A security vulnerability exists in Google Chrome versions prior to 85.0.4183.83. An attacker can exploit this vulnerability to bypass security restrictions...

Google Chrome Security Bypass Vulnerability (CNVD-2020-49914)

Google Chrome is a web browser. A security vulnerability exists in Google Chrome versions prior to 85.0.4183.83. An attacker can exploit this vulnerability to bypass security restrictions...

Google Chrome Code Execution Vulnerability (CNVD-2020-49906)

Google Chrome is a web browser from Google. A security vulnerability exists in WebUSB in versions of Google Chrome prior to 85.0.4183.83. A remote attacker can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service condition...

UBUNTU-CVE-2020-15665

Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. This could have resulted in an incorrect URL being shown when used in conjunction with other unexpected browser behaviors. This vulnerability affects Firefox 80...