CVE-2020-8021

a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5...

CVE-2020-12875

Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. An authenticated user could gain unauthorized access to sensitive information or functionality by manipulating specific parameters within the application...

Information disclosure

Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authenticate the connection between the client tool and the platform. An attacker may use the leaked Cloud Key to impersonate the client to connect to the platform, resulting in...

Red Hat Keycloak Input Validation Error Vulnerability (CNVD-2020-41186)

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An input validation error vulnerability exists in ObjectInputStream in Red Hat Keycloak versions prior to 11.0.0, which stems from the program...

Symantec Endpoint Protection Manager Path Traversal Vulnerability

Symantec Endpoint Protection Manager SEPM is a suite of enterprise-grade virus protection software from Symantec USA. The software protects against malicious attacks such as viruses, worms, and Trojan horses. A path traversal vulnerability exists in Symantec SEPM versions prior to 14.3. A remote...

CVE-2020-7647

All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors...

Zulip Desktop Trust Management Issue Vulnerability

Zulip Desktop is a desktop version of the team chat application from Zulip USA. A trust management issue vulnerability exists in Zulip Desktop versions prior to 5.2.0, which stems from a lack of validation of SSL certificates. The vulnerability can be exploited by an attacker to obtain sensitive...

PT-2020-12544 · Freerdp +6 · Freerdp +6

Name of the Vulnerable Software and Affected Versions: FreeRDP versions 2.0.0 and earlier Description: The issue is related to an out-of-bound read in the ntlm read AuthenticateMessage function. This has been fixed in version 2.1.0. Recommendations: For FreeRDP versions 2.0.0 and earlier, update ...

OpenStack Keystone Code Issue Vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA in collaboration with Rackspace in the U.S. OpenStack Keystone is a module used in OpenStack to manage the authentication, service rules, and service token functions. A security...

phpList cross-site scripting vulnerability (CNVD-2020-41816)

phpList is an open source newsletter and email marketing software from phpList UK. A cross-site scripting vulnerability exists in versions of phpList prior to 3.5.3. The vulnerability can be exploited by an attacker to elevate privileges with the help of the file lists/admin/template.php...

Roundcube Webmail Cross-Site Request Forgery Vulnerability (CNVD-2020-31750)

Roundcube Webmail is an open source browser-based IMAP client that supports address book management, message searching, spell checking and more. A cross-site request forgery vulnerability exists in Roundcube Webmail versions prior to 1.4.4. The vulnerability stems from a WEB application that does...

Zoom IT installer unauthorized operation vulnerability

Zoom IT is a screen zoom and annotation tool for technical presentations from Zoom USA. A security vulnerability exists in versions of Zoom IT installer ZoomInstallerFull.msi prior to 4.6.10 for Windows-based platforms. An attacker can exploit the vulnerability to delete restricted files...

PT-2020-3644 · Roundcube +4 · Roundcube Webmail +4

Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions prior to 1.4.4 Description: The issue is related to a cross-site scripting XSS vulnerability in the rcube washtml.php file of Roundcube Webmail. This vulnerability occurs because JavaScript code can be present in th...

OpenSC Resource Management Error Vulnerability

OpenSC is an open source smart card tool and middleware. A resource management error vulnerability exists in coolkeyfreeprivatedata in versions prior to OpenSC 0.20.0. The vulnerability arises from mismanagement of system resources e.g., memory, disk space, files, etc. by a networked system or...

dom4j code problem vulnerability

dom4j is an open source framework for processing XML . A code issue vulnerability exists in dom4j versions prior to 2.1.3. The vulnerability stems from an improperly designed or implemented code development process for a web-based system or product. No detailed vulnerability details are provided ...

PT-2020-2761 · Red Hat · Undertow

Name of the Vulnerable Software and Affected Versions: Undertow versions 2.0.29.Final and before Description: A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009. This issue allows a remote, unauthenticated attacker to read web...

CVE-2018-21168

Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D7000 before 1.0.1.52, D7800 before 1.0.1.31, D8500 before 1.0.3.36, JNR1010v2 before 1.1.0.46, JR6150 before 1.0.1.14, JWNR2010v5 before 1.1.0.46, PR2000 before 1.0.0.20, R6050 before 1.0.1.14, R6220 before...

CVE-2020-1845

Huawei PCManager product with versions earlier than 10.0.5.53 have a local privilege escalation vulnerability. An authenticated, local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege...

CVE-2020-6826

Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affec...

F5 NGINX Controller Information Disclosure Vulnerability (CNVD-2020-33346)

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in F5 NGINX Controller versions prior to 3.3.0 that originates when NGINX Controlle...