ALPINE-CVE-2020-14350

It was found that some PostgreSQL extensions did not use searchpath safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affect...

ALEOS Command Injection Vulnerability

ALEOS is an integrated development environment for building customized embedded M2M applications. A command injection vulnerability exists in the AT command interface in ALEOS versions prior to 4.11.0, 4.9.4, and no detailed vulnerability details are available at this time...

PYSEC-2020-266

Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to...

Cisco Data Center Network Manager Authorization Bypass Vulnerability

Cisco Data Center Network Manager DCNM is a data center management system from Cisco. The system works with Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting. An authorization issue vulnerability exists in the Web management interface in Cis...

DEBIAN-CVE-2020-14356

A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system...

mysql: C API unspecified vulnerability (CPU Apr 2020)

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise...

Intel Graphics Drivers Buffer Overflow Vulnerability (CNVD-2020-49543)

Intel Graphics Drivers is an integrated graphics driver from Intel USA. A security vulnerability exists in the kernel mode driver in Intel Graphics Drivers versions prior to 26.20.100.7755. An attacker could exploit this vulnerability to cause a denial of service...

PT-2020-6397 · Libraw +5 · Libraw +5

Name of the Vulnerable Software and Affected Versions: Libraw versions prior to 0.20.1 Description: The issue is related to a stack buffer overflow in the LibRaw::identify process dng fields function within the identify.cpp component of the Libraw image processing library. This overflow can be...

In Go before 1.13.13 and 1.14.x before 1.14.5 Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus X.509 certificate verification is incomplete.

...

Apple iTunes for Windows ImageIO Out-of-Bounds Write Vulnerability (CNVD-2020-51492)

Apple iTunes for Windows is a Windows-based media player application from Apple.ImageIO is one of the components that reads and writes image data. A security vulnerability exists in the ImageIO component in Apple iTunes for Windows versions prior to 12.10.8. The vulnerability can be exploited to...

Apple iTunes for Windows ImageIO Component Remote Code Execution Vulnerability

Apple iTunes for Windows is a Windows-based media player application from Apple.ImageIO is one of the components that reads and writes image data. A security vulnerability exists in the ImageIO component in Apple iTunes for Windows versions prior to 12.10.8. The vulnerability can be exploited to...

PT-2020-6481 · Openexr +5 · Openexr +5

Name of the Vulnerable Software and Affected Versions: OpenEXR versions prior to 3.0.0-beta Description: A flaw in the Dwa decompression functionality of OpenEXR's IlmImf library can cause a NULL pointer dereference when processing a crafted input file supplied by an attacker. This could lead to ...

UBUNTU-CVE-2020-13295

For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF...

JetBrains TeamCity Elevation of Privilege Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exists in versions of...

nodejs-lodash: prototype pollution in zipObjectDeep function

A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability...

UBUNTU-CVE-2020-16845

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs...

etcd Input Validation Error Vulnerability

etcd is a key-value storage system for distributed systems written in the Go language. An input validation error vulnerability exists in etcd versions prior to 3.3.23 and prior to 3.4.10. The vulnerability stems from a network system or product that does not properly validate input data. A remote...

Cisco Cyber Vision Center Software Access Control Error Vulnerability

Cisco Cyber Vision Center Software is a set of industrial control system ICS monitoring solution from the U.S. company Cisco Cisco. The product supports dynamic asset inventory, real-time network monitoring and other functions. An access control error vulnerability exists in the access control...

PT-2020-20826 · Apple · Itunes For Windows +7

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 13.6 Apple iPadOS versions prior to 13.6 Apple macOS Catalina versions prior to 10.15.6 Apple tvOS versions prior to 13.4.8 Apple watchOS versions prior to 6.2.8 Apple iTunes for Windows versions prior to 12.10.8...

Solidus Input Validation Error Vulnerability

Solidus is an open source e-commerce system. An input validation error vulnerability exists in Solidus versions prior to 2.8.6, prior to 2.9.6, and prior to 2.10.2. The vulnerability stems from a network system or product that does not properly validate incoming data. No detailed vulnerability...