CVE-2020-9486: Insertion of Sensitive Information into Log File

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext...

JerryScript has an unspecified vulnerability (CNVD-2022-11531)

JerryScript is a lightweight JavaScript engine from the JerryScript project. A security vulnerability exists in JerryScript vm/opcodes.c version 2.2.0, which can be exploited by attackers to hijack the control flow via the control register...

The SingleDocParser::HandleFlowSequence function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.

...

An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap HandleMap HandleFlowSequence HandleSequence HandleNode. Remote attackers could leverage this vulnerability to cause a denial-of-service via a cpp file.

...

The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.

...

CVE-2020-13991

vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register...

CVE-2020-13991

vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register...

UBUNTU-CVE-2020-13991

vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register...

CVE-2020-13991

vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register...

CVE-2020-13991

Removed by vendor...

PT-2020-13820

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue in JerryScript allows attackers to hijack the flow of control by controlling a register, which is related to the vm/opcodes.c file. Recommendations For JerryScript version 2.2.0, at the moment,...

CVE-2020-13991: Undefined Security Weakness

vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register...

Denial Of Service (DoS)

ufraw is vulnerable to stack-based buffer overflow. It is due to a flaw in the findgreen function, as used in ufraw-batch and many other products, may allow a remote attacker to cause a control-flow hijack, denial-of-service, or unspecified other impact via a maliciously crafted raw photo file...

Stable Channel Update for Desktop

The stable channel has been updated to 85.0.4183.121 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. A list of all changes is available in the log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The...

UBUNTU-CVE-2020-13300

GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow...

PT-2020-13441 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.3 through 13.3.3 Description: The issue concerns an OAuth authorization scope change without user consent in the middle of the authorization flow. Recommendations: For GitLab CE/EE versions 13.3 through 13.3.3, update...

ndpi:fuzz_process_packet: Use-of-uninitialized-value in ndpi_search_kerberos

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4833559658102784 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzprocesspacket Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

PT-2020-21012

Name of the Vulnerable Software and Affected Versions swagger-ui versions prior to 3.20.9 Description The issue is related to Cross-Site Scripting XSS due to the failure to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. Recommendations Upgrad...

PT-2020-21953

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash occurred due to a segmentation fault on an unknown address. The crash involved the ndpi free and ndpi free flow functions, and it happened in the...

CVE-2020-3542

A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could explo...