PT-2020-14544 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax mail...

Mattermost Server Code Issue Vulnerability (CNVD-2020-35336)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.0.0, prior to 3.10.2, and prior to 3.9.2, which stems from the program's inability to disable a session. No details of the...

PT-2020-14070 · Squirrelmail · Squirrelmail

Name of the Vulnerable Software and Affected Versions: SquirrelMail version 1.4.22 Description: The issue arises in compose.php, where the $attachments value from an HTTP POST request is passed to unserialize. This could potentially lead to PHP object injection. However, the vendor disputes this,...

PT-2020-6431 · Nextcloud +1 · Nextcloud Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client versions prior to 3.3.1 Description: The issue is related to the lack of SSL certificate verification when using the "Register with a Provider" flow in the Nextcloud Desktop Client, allowing a remote attacker to impac...

PT-2020-19702 · Casperjs Team · Casperjs

Name of the Vulnerable Software and Affected Versions: casperjs versions affected versions not specified Description: The issue concerns a Prototype Pollution vulnerability via the mergeObjects utility function in casperjs, a navigation scripting and testing utility for PhantomJS and SlimerJS. Th...

CVE-2020-7504

A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to disable the webserver service on the device when specially crafted network packets are sent...

CVE-2020-7504

A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to disable the webserver service on the device when specially crafted network packets are sent...

Chinese Digital Media (Beijing) Technology Co., Ltd. gaZee APP exists denial of service vulnerability

The Crunchy Background app is a novel reading platform software that allows you to read various novels in a conversational mode. Huayu Digital Media Beijing Technology Co. Gazee App has a denial-of-service vulnerability that can be exploited by an attacker to cause the application's protection...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Intel Microcode regression (USN-4385-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4385-2 advisory. USN-4385-1 provided updated Intel Processor Microcode. Unfortunately, that update prevented certain processors in the Intel Skylake family...

PT-2020-13229 · Redash · Redash

Name of the Vulnerable Software and Affected Versions: Redash open-source versions 8.0.0 and prior Description: An authenticated Server-Side Request Forgery SSRF was discovered via the JSON data source. This issue provides flexibility in crafting HTTP requests, such as adding headers and selectin...

Linux: Blacklisted Services

Some services have security issues or should not be running on the host for other reasons. This script checks if any of the given services is running on the host by using systemctl. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and...

Universal Plug and Play (UPnP) SUBSCRIBE can be abused to send traffic to arbitrary destinations

Overview The Universal Plug and Play UPnP protocol in effect prior to April 17, 2020 can be abused to send traffic to arbitrary destinations using the SUBSCRIBE functionality. Description The UPnP protocol, as specified by the Open Connectivity Foundation OCF, is designed to provide automatic...

GHSA-W42G-7VFC-XF37 Introspection in schema validation in Apollo Server

We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The Resolution section contains details on patched versions. Impact If subscriptions: false is passed to the ApolloServer constructor options, there is no impact. If implementors were not...

Unspecified Vulnerability in Samsung Mobile Devices (CNVD-2020-32788)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices have a security vulnerability that can be exploited by attackers to turn off the SEAndroid protection mechanism...

Elastic Stack 6.8.9 and 7.7.0 security update

Kibana upgrade assistant prototype pollution flaw ESA-2020-05 Kibana versions between 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to...

PT-2020-8637 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Grafana version 5.3.1 Description: The issue is related to an incomplete fix, resulting in a XSS vulnerability via the "Dashboard Text Panel" screen. This allows for potential exploitation. Recommendations: For Grafana version 5.3.1, consider...

DEBIAN-CVE-2020-11041

In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend alsa, oss, pulse, .... The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot...

UBUNTU-CVE-2019-6342

An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4...

PT-2020-13516 · Tenda · Tenda Ac6 +3

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 1.0 V15.03.05.19 multi TD01 Tenda AC9 version 1.0 V15.03.05.196318 CN Tenda AC9 version 3.0 V15.03.06.42 multi Tenda AC15 version 1.0 V15.03.05.19 multi TD01 Tenda AC18 version 15.03.05.196318 CN Description: A buffer overfl...

PT-2020-4065 · Jw · Jw.Util

Name of the Vulnerable Software and Affected Versions: jw.util versions prior to 2.3 Description: The issue is related to errors in processing YAML files when loading configuration, allowing a remote attacker to execute arbitrary operating system commands. This is due to the lack of safe load whe...