PT-2020-6431 · Nextcloud +1 · Nextcloud Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client versions prior to 3.3.1 Description: The issue is related to the lack of SSL certificate verification when using the "Register with a Provider" flow in the Nextcloud Desktop Client, allowing a remote attacker to impac...

CVE-2020-8184

A flaw was found in rubygem-rack. An attacker may be able to trick a vulnerable application into processing an insecure non-SSL or cross-origin request if they can gain the ability to write arbitrary cookies that are sent to the application. The highest threat from this vulnerability is to data...

CVE-2020-14062

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigatio...

CVE-2020-14061

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigatio...

CVE-2020-14195

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.5. FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigation Th...

The vulnerability of the opj_t1_clbl_decode_processor function (openjp2/t1.c) in the OpenJPEG image encoding and decoding library allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the opjt1clbldecodeprocessor function in the OpenJPEG image encoding and decoding library is related to writing beyond the buffer boundaries in memory when qmfbid == 1. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2020-5644

Name of the Vulnerable Software and Affected Versions rack versions prior to 2.2.3 rack versions prior to 2.1.4 Description A security issue exists due to a reliance on cookies without proper validation or integrity checks, making it possible for an attacker to forge a secure or host-only cookie...

The vulnerability of the OpenOffice office suite, related to integer overflow, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the OpenOffice office suite is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...

The vulnerability of the OpenOffice office suite, related to integer overflow, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the OpenOffice office suite is related to a numerical overflow vulnerability. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...

The vulnerability of the QPRO file in the OpenOffice office suite allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the OpenOffice office suite is related to the execution of operations beyond buffer boundaries. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and even cause service interruptions...

CVE-2020-12268

An integer overflow was found in jbig2dec, which causes an out-of-bounds read/write in the jbig2imagecompose function. This flaw could potentially result in the execution of code on the system. Applications that use jbig2dec with untrusted input may be vulnerable to this flaw. The highest threat...

CVE-2020-11972

A flaw was found in camel up to versions 2.25.1 and 3.x. Apache Camel RabbitMQ enables java deserialization, by default, without any means of disabling which can lead to arbitrary code being executed. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

CVE-2020-11973

A flaw was found in camel. Apache Camel RabbitMQ enables java deserialization, by default, without any means of disabling which can lead to arbitrary code being executed. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigation...

CVE-2020-13430

A flaw was found in grafana Tag value XSS via the OpenTSDB datasource are possible. The highest threat from this vulnerability is to data confidentiality and integrity...

PT-2020-6852 · Dijit +3 · Dijit +3

Name of the Vulnerable Software and Affected Versions: Dijit versions 1.11.0 through 1.11.10 Dijit versions 1.12.0 through 1.12.8 Dijit versions 1.13.0 through 1.13.7 Dijit versions 1.14.0 through 1.14.6 Dijit versions 1.15.0 through 1.15.3 Dijit versions 1.16.0 through 1.16.2 Description: The...

PT-2020-3636 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.4.2 WordPress versions 3.7.34 through 5.3.4 Description: The issue is related to the lack of neutralization of script-related HTML tags on a web page, which can be exploited by a remote attacker to compromise dat...

jackson-mapper-asl: XML external entity similar to CVE-2016-3720

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity XXE vulnerability affects codehaus's jackson-mapper-asl libraries. This vulnerability is similar to CVE-2016-3720. The primary threat from this flaw is data integrity...

jackson-databind: Serialization gadgets in anteros-core

A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

jackson-databind: Lacks certain xbean-reflect/JNDI blocking

A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availabili...

jackson-databind: Serialization gadgets in ibatis-sqlmap

A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...