PT-2020-10922 · Red Hat · Quay

Name of the Vulnerable Software and Affected Versions: quay-2 affected versions not specified Description: A stored XSS issue has been found in the super user function of quay, allowing attackers to inject scripts via the name field of the service key. These scripts can run when admin users attem...

GHSA-6Q48-VJQ2-MWCJ Command Injection in umount

All versions of umount are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the umount function . This may allow attackers to execute arbitrary code in the system if the device value passed to the function is user-controlled...

GHSA-96R7-MRQF-JHCC Prototype Pollution in ini-parser

All versions of ini-parser are vulnerable to prototype pollution. The parse function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available. Conside...

PT-2020-2788 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insecure privilege management in the Windows operating system kernel. It allows an attacker to potentially elevate their privileges and execute arbitrary code using ...

PT-2020-3356 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in processing objects in memory within the Windows operating system kernel. It allows an attacker to potentially elevate their privileges using a specially...

PT-2020-15097 · Huawei · Huawei +1

Name of the Vulnerable Software and Affected Versions: Huawei products affected versions not specified Description: The issue is related to out of bounds OOB read vulnerabilities in the implementation of the Common Open Policy Service COPS protocol. A specific decoding function may cause an...

Security Bulletin: IBM Spectrum Scale GUI is affected by verbose error message (CVE-2020-4357)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale GUI. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4357 DESCRIPTION: IBM Spectrum Scale could allow a remote attacker to obtain sensitive information when a detailed technic...

PT-2020-2343 · Microsoft · Active Directory Federation Services +1

Name of the Vulnerable Software and Affected Versions: Active Directory Federation Services ADFS affected versions not specified Description: The issue is related to a cross-site scripting XSS vulnerability. This occurs when Active Directory Federation Services ADFS does not properly sanitize use...

PT-2020-8665 · Pip +1 · Pip +1

Name of the Vulnerable Software and Affected Versions: pip all versions Description: An issue was discovered in pip because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the...

PT-2020-2506 · Cisco · Cisco Ftd

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Threat Defense FTD Software affected versions not specified Description: A vulnerability in the application policy configuration of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to...

PT-2020-6298

Name of the Vulnerable Software and Affected Versions Modicon M218, M241, M251, and M258 controllers affected versions not specified Description A Cleartext Transmission of Sensitive Information issue exists, which could leak sensitive information transmitted between the software and the...

PT-2020-2272 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in handling objects in memory within the Windows operating system kernel. It allows an attacker to potentially elevate their privileges using a specially...

PT-2020-2196 · Adobe +1 · Type Manager Library +1

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: A remote code execution issue exists in Microsoft Windows due to the improper handling of a specially-crafted multi-master font in the Adobe Type 1 PostScript format by the Window...

Prototype Pollution

Overview All versions of ini-parser are vulnerable to prototype pollution. The parse function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...

PT-2020-17797 · Ultralog · Ultralog Express

Name of the Vulnerable Software and Affected Versions: UltraLog Express device management software affected versions not specified Description: The issue concerns the storage of user information in cleartext by the UltraLog Express device management software. This allows any user to obtain accoun...

PT-2020-12389 · Openwrt · Openwrt Luci

Name of the Vulnerable Software and Affected Versions: OpenWrt LuCI versions git-20.x Description: The issue allows remote unauthenticated attackers to retrieve the list of installed packages and services. The vendor disputes the significance of this report, stating that the same information is...

Command Injection

Overview pulverizr is a to smash your images down to size. Affected versions of this package are vulnerable to Command Injection. Within lib/job.js, the variable filename can be controlled by the attacker. This function uses the variable filename to construct the argument of the exec call without...

PT-2020-4012 · Intel · Intel Processors

Name of the Vulnerable Software and Affected Versions: IntelR Processors affected versions not specified Description: The issue is related to improper data forwarding in some data cache for IntelR Processors, which may allow an authenticated user to potentially enable information disclosure via...

Security Bulletin: IBM® Db2® is vulnerable to denial of service (CVE-2020-4161)

Summary Db2 is vulnerable to a denial of service. Authenticated users can use specific commands on a Db2 server to cause the server to terminate abnormally Vulnerability Details CVEID: CVE-2020-4161 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow an...

PT-2020-1987 · Cisco · Cisco Fxos +2

Name of the Vulnerable Software and Affected Versions: Cisco FXOS Software and Cisco NX-OS Software affected versions not specified Description: A vulnerability in the Cisco Discovery Protocol feature could allow an unauthenticated, adjacent attacker to execute arbitrary code as root or cause a...