GHSA-J257-JFVV-H3X5 Privilege Escalation in Channelmgnt plug-in for Sopel

Impact Malicious users are able to op/voice and take over a channel Patches On version 1.0.3 Workarounds Disable channelmgnt References https://phab.bots.miraheze.wiki/T117 For more information If you have any questions or comments about this advisory: Email us at staffatmirahezebotsdotorg...

Privilege Escalation in Channelmgnt plug-in for Sopel

Impact Malicious users are able to op/voice and take over a channel Patches On version 1.0.3 Workarounds Disable channelmgnt References https://phab.bots.miraheze.wiki/T117 For more information If you have any questions or comments about this advisory: Email us at staffatmirahezebotsdotorg...

KLA11974 ACE vulnerabilities in Microsoft Apps

ACE vulnerabilities were found in Microsoft Apps. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2020-17003 CVE-2020-16918 Related products Yammer-Desktop-App CVE list CVE-2020-17003 critical CVE-2020-16918 critical KB list Solution Install...

KLA11977 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges, spoof user interface, cause denial of service, bypass security restrictions. Below is a complete list of...

CVE-2020-15197

In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are access...

KLA11965 Multiple vulnerabilities in Apple iCloud

Multiple vulnerabilities were found in Apple iCloud. Malicious users can exploit these vulnerabilities to perform cross-site scripting attack, cause denial of service. Below is a complete list of vulnerabilities: 1. An input validation vulnerability in WebKit can be exploited to perform cross-sit...

CVE-2020-13307

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access...

KLA11958 SB vulnerability in Microsoft SQL Server

Security bypass vulnerability was found in Microsoft SQL Server. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories CVE-2020-1044 Related products Microsoft-SQL-Server CVE list CVE-2020-1044 high KB list Solution Install necessary updates from the ...

KLA11959 SUI vulnerability in Xamarin

A spoofing vulnerability was found in Xamarin. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2020-16873 Related products Xamarin CVE list CVE-2020-16873 critical KB list Solution Install necessary updates from the KB section, that are listed in yo...

KLA11936 ACE vulnerability in Microsoft Dynamics

A remote code execution vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2020-1182 Related products Microsoft-Dynamics-365 CVE list CVE-2020-1182 critical KB list Solution Install necessary updates fro...

GHSA-3MVG-RRRW-M7PH Ability to change order address without triggering address validations in solidus

Impact This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zo...

CVE-2020-5414

VMware Tanzu Application Service for VMs 2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7 contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are...

KLA11870 PE vulnerability in Microsoft Browser

An elevation of privilege vulnerability was found in Microsoft Browser. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2020-1341 Related products Microsoft-Edge CVE list CVE-2020-1341 unknown KB list Solution Install necessary updates from the Settings...

KLA11912 SB vulnerability in Mozilla Firefox

A security bypass vulnerability was found in Mozilla Firefox. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories MFSA2020-28 Related products Mozilla-Firefox CVE list CVE-2020-15648 high Solution Update to the latest version Download Firefox Impact...

KLA12084 DoS vulnerability in Apache Tomcat

DoS vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to cause denial of service. Original advisories Apache Tomcat 7.x vulnerabilities Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is...

Exploit for Path Traversal in Vmware Spring_Cloud_Config

CVE-2020-5410 Spring Cloud Config directory traversal vulnera...

KLA11812 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Diagnostic Hub...

KLA11786 OSI vulnerability in LibreOffice

OSI vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2020-12801 Related products LibreOffice CVE list CVE-2020-12801 warning Solution Update to the latest version Download LibreOffice Impacts OSI Obtain...

KLA12131 ACE vulnerability in PostgreSQL

A code execution vulnerability was found in PostgreSQL. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories PostgreSQL News Related products PostgreSQL CVE list CVE-2020-10733 high KB list 5003228 5003233 5003210 5003165 5003225 Solution Update to the...

KLA11775 XSS vulnerability in Microsoft Dynamics

XSS vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2020-1063 Related products Microsoft-Dynamics-365 CVE list CVE-2020-1063 warning KB list 4552002 4551998 Solution Install necessary updates from the K...