CVE-2020-10235

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of backupExistingDatabase in install/lib/class.FroxlorInstall.php...

CVE-2020-10237

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...

CVE-2020-10236

An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of createUserdataConf in...

CVE-2020-10237: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time,...

CVE-2020-10236: Improper Input Validation

An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of createUserdataConf in...

PT-2020-11991

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 0.10.14 Description An issue was discovered that allows remote attackers with access to the installation routine to execute arbitrary code. This is due to the database configuration options being passed unescaped to...

CVE-2020-10235: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of backupExistingDatabase in install/lib/class.FroxlorInstall.php...

CVE-2020-10221: Improper Neutralization of Special Elements used in an OS Command

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter...

SUSE SLES12 Security Update : mariadb (SUSE-SU-2020:0505-1)

This update for mariadb fixes the following issues : MariaDB was updated to version 10.2.31 GA bsc1162388. Security issues fixed : CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client bsc1162388. CVE-2019-18901: Fixed an unsafe path handling...

EulerOS 2.0 SP8 : python3 (EulerOS-SA-2020-1175)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service resource consumption via a ZIP bomb.CVE-2019-9674 -...

Authentication flaw

rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization...

CVE-2019-10796

rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization...

WS-2020-0343

ndpi in versions 1.7 to 3.2 is vulnerable to Heap-buffer-overflow, related to src/lib/protocols/dns.c, src/lib/protocols/fix.c, src/lib/protocols/ssh.c and src/lib/protocols/yahoo.c...

PT-2020-9942

Name of the Vulnerable Software and Affected Versions pacman versions prior to 5.2 Description The issue allows for arbitrary command injection in the apply deltas function, located in lib/libalpm/sync.c. This can be exploited when unsigned databases are used, and the user has enabled the...

CVE-2019-10796: Improper Neutralization of Special Elements used in an OS Command

rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization...

PT-2020-9147

Name of the Vulnerable Software and Affected Versions rpi versions 0.0.0 through 0.0.3 Description The issue allows execution of arbitrary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the argument of exec function without any sanitization...

WS-2020-0328

nDPI before 3.4 is vulnerable to heap-buffer-overflow in ndpinetbiosnameinterpret, related to src/lib/protocols/netbios.c...

WS-2020-0333

In ndpi in versions 2.0 to 3.2 is vulnerable toHeap-buffer-overflow in searchvaliddns , related to src/lib/protocols/dns.c...

CVE-2020-7597

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...

CVE-2020-7597

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...