CVE-2020-13931

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

(0Day) Linux Kernel eBPF Improper Input Validation Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF...

(0Day) Eaton EASYsoft E70 File Parsing Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Eaton EASYsoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of E70...

Cross-site Scripting (XSS)

moodle/moodle is vulnerable to cross-site scripting XSS. The vulnerability exists through the lack of sanitization of filter in the tag manager...

Google Android Security Vulnerability

Google Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA. Google Android Pixel has a security vulnerability, there is currently no information about this vulnerability, please stay tuned to CNNVD or the manufacturer's announcement...

CVE-2020-2320: Download of Code Without Integrity Check

Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads...

PT-2020-17161

Name of the Vulnerable Software and Affected Versions Tesla Model X vehicles before 2020-11-23 Description The issue concerns key fobs in Tesla Model X vehicles that accept firmware updates without signature verification, allowing attackers to construct firmware that retrieves an unlock code from...

CVE-2020-29367

blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data...

PT-2020-10273

Name of the Vulnerable Software and Affected Versions B&R Industrial Automation APROL versions prior to R4.2 V7.08 Description An issue was discovered that allows Process Variables PVs to be changed without encryption. This can be achieved by utilizing the IosHttp service and the JSON interface...

CVE-2020-28332: Download of Code Without Integrity Check

Barco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Versions: 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W firmware does not perform verification of digitally signed firmware updates and is susceptible to processing and installing...

PT-2020-14314

Name of the Vulnerable Software and Affected Versions October CMS versions 1.0.319 through 1.0.468 Description The issue allows backend users with access to upload files to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by...

VMware ESXi SLP Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of VMware ESXi. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SLP messages. The issue results from the lack of validating the...

PT-2020-16578

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 83 Description The issue arises when the Remote Debugging via USB feature is enabled in Firefox for Android on Android versions prior to 6.0, allowing untrusted apps to connect and operate with browser privileges, thu...

PT-2020-6368

Name of the Vulnerable Software and Affected Versions Easergy T300 versions 2.7 and older Description The issue is related to the lack of encryption for sensitive data in the firmware of the Easergy T300 RTU. This could allow a remote attacker to gain unauthorized access to network traffic over t...

PT-2020-6493

Name of the Vulnerable Software and Affected Versions IBM DB2 affected versions not specified Description The issue is related to a lack of size checking in the data copying mechanism of the IBM DB2 database management system. This could allow an attacker to execute arbitrary code with root...

PT-2020-16688

Name of the Vulnerable Software and Affected Versions Anuko Time Tracker version 1.19.23.5311 Description The issue is related to a lack of rate limit on the password reset module, which allows an attacker to perform a Denial of Service attack on any legitimate user's mailbox. Recommendations For...

Adobe Acrobat Pro DC PDF Export Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS.Lack of validation in getrawsocket in drivers/vhost/net.c of an skfamily field allows to attacker perform ioctl2 calls on the '/dev/vhost-net' device may use this flaw to crash the kernel...

U.S. Dept Of Defense: Unauthorized access to admin panel of the Questionmark Perception system at https://██████████

Summary: Due to the lack of access control, an anonymous attacker can compromise the administrator account on the Questionmark Perception system. Description: By using the service description which publicly accessible on the internet, and by bypassing the access control, an anonymous attacker can...

CVE-2020-11162: Buffer Copy without Checking Size of Input

u'Possible buffer overflow in MHI driver due to lack of input parameter validation of EOT events received from MHI device side' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,...