[ASA-202101-38] dnsmasq: multiple issues

Arch Linux Security Advisory ASA-202101-38 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25684 CVE-2020-25685 CVE-2020-25686 CVE-2020-25687 Package : dnsmasq Type : multiple issues Remote : Yes Link :...

Information Disclosure

apache tomcat is vulnerable to information disclosure. Security constraints can be bypassed to obtain and view JSP source code in certain configurations, when serving resources from a network location using the NTFS file system. The vulnerability is caused by the insufficient validation for the :...

[ASA-202101-20] vivaldi: multiple issues

Arch Linux Security Advisory ASA-202101-20 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-15995 CVE-2020-16043 CVE-2021-21106 CVE-2021-21107 CVE-2021-21108 CVE-2021-21109 CVE-2021-21110 CVE-2021-21111 CVE-2021-21112 CVE-2021-21113 CVE-2021-21114...

Privilege Escalation

php7 is vulnerable to privilege escalation. The vulnerability is possible due to insufficient validation of URL performed via the "FILTERVALIDATEURL" setting. A remote attacker can use the "@" characters in the URL to bypass implemented filter and force the application to accept arbitrary URL...

Design/Logic Flaw

There is an out-of-bound read vulnerability in huawei smartphone Mate 30 versions earlier than 10.1.0.156 C00E155R7P2. An attacker with specific permission can exploit this vulnerability by sending crafted packet with specific parameter to the target device. Due to insufficient validation of the...

Advantech R-SeeNet SQL Injection (CVE-2020-25157)

A SQL injection vulnerability exists in Advantech R-SeeNet. The vulnerability is due to insufficient validation on the deviceid parameter within deviceposition.php...

Authorization Bypass

chromium is vulnerable to authorization bypass. Insufficient data validation in cros-disks allows an attacker to bypass authorization...

CVE-2020-15292 Lack of validation on data read from guest memory in Bitdefender HVI (VA-9333)

Lack of validation on data read from guest memory in IntPeGetDirectory, IntPeParseUnwindData, IntLogExceptionRecord, IntKsymExpandSymbol and IntLixTaskDumpTree may lead to out-of-bounds read or it could cause DoS due to integer-overflor IntPeGetDirectory, TOCTOU IntPeParseUnwindData or insufficie...

[ASA-202012-14] chromium: multiple issues

Arch Linux Security Advisory ASA-202012-14 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Package : chromium Type : multiple issues Remote : Yes Link :...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. The vulnerability exists due to insufficient validation in external protocols in Shell Integration which allows a malicious user to launch external programs via a crafted HTML page...

PHP-Fusion downloads.php Privilege Escalation (CVE-2020-24949)

A privilege escalation vulnerability exists in PHP-Fusion. The vulnerability is due to insufficient validation of HTTP request parameters in downloads.php...

VestaCP 0.9.8-26 Token Session

Document Title: =============== VestaCP v0.9.8-26 - LoginAs Token Session Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2240 Release Date: ============= 2020-11-26 Vulnerability Laboratory ID VL-ID: ====================================...

Western Digital My Cloud Multiple Products 5.0 < 5.06.115 Multiple Vulnerabilities

Multiple Western Digital My Cloud products are prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...

CVE-2020-28971

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths...

Authentication flaw

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths...

CVE-2020-28971

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths...

CVE-2020-9117

HUAWEI nova 4 versions earlier than 10.0.0.165C01E34R2P4 and SydneyM-AL00 versions earlier than 10.0.0.165C00E66R1P5 have an out-of-bounds read and write vulnerability. An attacker with specific permissions crafts malformed packet with specific parameter and sends the packet to the affected...

Design/Logic Flaw

HUAWEI nova 4 versions earlier than 10.0.0.165C01E34R2P4 and SydneyM-AL00 versions earlier than 10.0.0.165C00E66R1P5 have an out-of-bounds read and write vulnerability. An attacker with specific permissions crafts malformed packet with specific parameter and sends the packet to the affected...

[ASA-202011-26] gitea: insufficient validation

Arch Linux Security Advisory ASA-202011-26 ========================================== Severity: Medium Date : 2020-11-26 CVE-ID : CVE-2020-28991 Package : gitea Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1299 Summary ======= The package gitea before...

VestaCP v0.9.8-26 - (LoginAs) Token Session Vulnerability

Document Title: =============== VestaCP v0.9.8-26 - LoginAs Token Session Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2240 Release Date: ============= 2020-11-26 Vulnerability Laboratory ID VL-ID: ====================================...