CVE-2020-13413

An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force...

Linux kernel denial of service vulnerability (CNVD-2020-28264)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the drivers/spi/spi-dw.c file in Linux kernel versions prior to 5.4.17. An attacker can exploit this vulnerability to cause a denial...

WordPress Access Control Error Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An access control error vulnerability exists in WordPress versions 3.7 through 5.4. The vulnerability arises...

Linux kernel buffer overflow vulnerability (CNVD-2020-37934)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. The 'mwifiexcmdappendvsietlv' function in the drivers/net/wireless/marvell/mwifiex/scan.c file in versions of the Linux kernel prior to 5.5.4 has a buffer overflow...

DEBIAN-CVE-2020-11027

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously...

CVE-2020-9294

An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface...

PT-2020-2499 · Oracle · Oracle Outside In Technology

Name of the Vulnerable Software and Affected Versions: Oracle Outside In Technology version 8.5.4 Description: The issue is related to insufficient access controls in the Outside In Filters component of Oracle Outside In Technology, a suite of software development kits SDKs. This can be exploited...

DEBIAN-CVE-2020-8835

In the Linux kernel 5.5.0 and newer, the bpf verifier kernel/bpf/verifier.c did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the...

ALPINE-CVE-2020-0556

Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access...

CVE-2020-2536

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Filters. The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In...

PYSEC-2020-198

Ansible prior to 1.5.4 mishandles the evaluation of some strings...

CVE-2019-20154

An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. A cross-site scripting XSS vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitrary web script or HTML...

Determine Contract Lifecycle Management XML External Entity Injection Vulnerability

Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. An XML external entity injection vulnerability exists in the definitionuploadattach.jsp file in Determine CLM version 5.4, which can be exploited by an attacker...

Determine Contract Lifecycle Management Cross-Site Scripting Vulnerability

Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. A cross-site scripting vulnerability exists in the getchart.jsp file in Determine CLM version 5.4, which stems from the lack of proper validation of client-side...

PHPOK system 5.4 file upload vulnerability in the background of Shenzhen Kunshuo Technology Co.

PHPOK system hereinafter referred to as OK system is a content management system for website construction developed by Shenzhen Kunshuo Technology Co., Ltd formerly known as PHPOK Studio, written in PHP, using MySQL database storage by default, and based on the LGPL open-source agreement licensed...

Linux kernel memory misreference vulnerability (CNVD-2019-45886)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A memory misreference vulnerability exists in Linux kernel versions prior to 5.4.2. An attacker could exploit this...

Cloudera Manager Cross-Site Scripting Vulnerability (CNVD-2020-14237)

Cloudera Manager is a suite of Hadoop data management software from Cloudera. The software supports creating clusters, authentication, data backup and recovery, and more. A cross-site scripting vulnerability exists in Cloudera Manager versions prior to 5.4.3. The vulnerability stems from the WEB...

PT-2019-4661 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.4.2 Description: The issue is related to the io uring feature in the Linux kernel, which can lead to requests being executed with UID 0 and full capabilities, even when initiated by an unprivileged user. This...

TYPO3 Authorization Issue Vulnerability (CNVD-2019-41222)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 versions prior to 4.3.12, 4.4.x prior to 4.4.9, and 4.5.x prior to 4.5.4. An attacker can exploit the vulnerability by sending a specially crafted...

Mapserver Input Validation Error Vulnerability

Mapserver is the Open Source Geospatial OSGeo Foundation's suite of open source platforms for publishing spatial data and interactive map applications to the Web. An input validation error vulnerability in Mapserver versions 5.2, 5.4, and 5.6 prior to 5.6.5-2, which stems from the program failing...