CVE-2020-35575

A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9201211 beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N,...

Fastadmin Code Injection Vulnerability

fastadmin is a set of website backend development framework based on ThinkPHP and Bootstrap. Fastadmin V1.0.0.20200506 beta has a security vulnerability that can be exploited by attackers to cause server-side template injection SST vulnerability attacks...

ClearSite Beta Remote File Inclusion (CVE-2010-2145)

A remote file inclusion vulnerability exists in ClearSite Beta. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

PT-2020-17143 · Blosc +1 · C-Blosc2 +1

Name of the Vulnerable Software and Affected Versions: Blosc C-Blosc2 versions through 2.0.0.beta.5 Description: The issue arises from a heap-based buffer overflow in the blosc2.c file when there is insufficient space to write compressed data. Recommendations: For versions through 2.0.0.beta.5,...

Blosc C-Blosc Buffer Error Vulnerability

Blosc C-Blosc2 is a code library from the Blosc team that enables deep compression of binary data. The goal of the software is to reduce the size of large datasets on disk or in memory, speeding up memory-bound computations. The software supports BloscLZ, a compression program based on FastLZ, LZ...

Google Is Testing End-to-End Encryption in Android Messages

For now, the security measure will be available only to people using the beta version of the app...

HorizontCMS 1.0.0-beta Shell Upload Exploit

This Metasploit module exploits an arbitrary file upload vulnerability in HorizontCMS 1.0.0-beta in order to execute arbitrary commands. The module first attempts to authenticate to HorizontCMS. It then tries to upload a malicious PHP file via an HTTP POST request to /admin/file-manager/fileuploa...

binutils security update

2.30-79.0.1 - Forward-port Oracle patches from 2.30-75.0.1 - Reviewed-by: Jose E. Marchesi 2.30-79 - Fix x86 assemblers handling of non-8-bit displacements. 1869401 2.30-77 - Add tests missing from PTGNUSEGMENT patch. 1870039 2.30-75.0.1 - Forward-port Oracle patches to OL8.3 beta. 2.30-76 - Have...

PT-2020-16680 · Horizontcms · Horizontcms

Name of the Vulnerable Software and Affected Versions: HorizontCMS versions prior to 1.0.0-beta patched, but version number remains the same Description: The issue allows an authenticated remote attacker with access to the FileManager to upload and execute arbitrary PHP code. This is achieved by...

bootstrap: XSS in the data-target attribute

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041...

libreswan bug fix and enhancement update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network VPN...

Design/Logic Flaw

An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. An insecure random number generator was used to generate various keys. An attacker with access to the user's encrypted data may be able to...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Dynamic Data Resolver - Version 1.0.1 beta

By Holger Unterbrink. Cisco Talos is releasing a new beta version of Dynamic Data Resolver DDR today. This release comes with a new architecture for samples using multi-threading. The process and thread tracing has been completely reimplemented. We also fixed a few bugs and memory leaks. Another...

Authentication flaw

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any...

Sensitive data exposure in NATS

Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The connection configuration options in these JavaScript-based implementations were...

CVE-2020-15174

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in...

CVE-2020-20800

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI...

Vulnerability Detection Pipeline (Beta)

Update October 22, 2020: The Vulnerability Detection Pipeline beta has been updated to include detections of all severities. It now gives visibility into upcoming and recently published detections with severity 3, 2 and 1 in addition to severity 5 and 4. The pipeline also supports a URL parameter...

GHSA-W7RC-RWVF-8Q5R The `size` option isn't honored after following a redirect in node-fetch

Impact Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relyin...