1566 matches found
EulerOS 2.0 SP2 : openssh (EulerOS-SA-2020-2376)
According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious...
XSS through image upload on contacts using svg file with png extension (NC-SA-2020-044)
A missing file type check in Nextcloud Contacts 3.4.0 allowed a malicious user to upload SVG files as PNG files to perform XSS attacks...
Cross site scripting
XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements, as opposed to the View function, which sanitizes the input correctly. A...
CVE-2020-15236
In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is...
EulerOS 2.0 SP3 : openssh (EulerOS-SA-2020-2112)
According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious...
CVE-2020-25728
The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm involving an increment that allows a malicious user to change any user's account password include the admin account...
CVE-2020-25728
The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm involving an increment that allows a malicious user to change any user's account password include the admin account...
CVE-2020-13307
Removed by vendor...
CVE-2020-13314
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages...
Design/Logic Flaw
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages...
CVE-2020-5369
Dell EMC Isilon OneFS (versions 8.2.2 and earlier) and Dell EMC PowerScale OneFS (version 9.0.0) contain a privilege-escalation vulnerability exploitable by an authenticated user via SyncIQ to access system management files. Root cause centers on elevated rights during management file access; imp...
EulerOS 2.0 SP5 : openssh (EulerOS-SA-2020-1928)
According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious...
Design/Logic Flaw
The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. This issue may lead to unauthorized access of private Git repositories as long as the malicious user knows or brute-forces the location of th...
Acronis: Cross Origin Resource Sharing Misconfiguration
Description :- Cross-Origin Resource Sharing CORS is a mechanism that uses additional HTTP headers to tell browsers to give a web application running at one origin, access to selected resources from a different origin. The CORS mechanism supports secure cross-origin requests and data transfers...
Debian DLA-2314-1 : clamav security update
Several vulnerabilities have been found in the ClamAV antivirus toolkit : CVE-2020-3327 An out of bounds read in the ARJ archive-parsing module could cause denial of service. The fix in 0.102.3 was incomplete. CVE-2020-3350 A malicious user could trick clamscan, clamdscan or clamonacc into moving...
CVE-2020-9311: Malicious user profile information can cause login form XSS
More info at https://www.silverstripe.org/download/security-releases/cve-2020-9311/...
Regular Expression Denial Of Service (ReDoS)
wicket is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability is possible due to improper usage of regular expression in trimParens field, allowing a malicious user to crash the application by passing malicious strings...
Regular Expression Denial Of Service (ReDoS)
html-dom-parser is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability is possible due to improper usage of regular expression in HEADREGEX and BODYREGEX, allowing a malicious user to crash the application by passing malicious strings...