CVE-2020-0500

In startInputUncheckedLocked of InputMethodManager.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

ALSA-2020:5500 Important: mariadb:10.3 security, bug fix, and enhancement update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb 10.3.27, galera 25.3.31. BZ1899082, BZ1899086 Security Fixes: mariadb: Insufficient SST method name check leading to cod...

mariadb:10.3 security, bug fix, and enhancement update

An update is available for Judy. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list MariaDB is a multi-user, multi-threaded SQL database server that is binary...

Sogou Input Method (Windows client) suffers from dll hijacking vulnerability

Sogou Input Method is a Chinese character input method tool launched in June 2006 by Sogou Sogou. A dll hijacking vulnerability exists in Sogou Input Method Windows client. An attacker can exploit this vulnerability to load a malicious dll and execute malicious code...

CVE-2020-35175

Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...

CVE-2020-35175

Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...

CVE-2020-35175

CVE-2020-35175 affects Frappe Framework 12 and 13 where the vulnerability lies in the frappe.client API not properly validating the HTTP method . The root cause is stated as a method validation issue within that API. The connected documents corroborate the same details across multiple sources (NV...

SUSE-SU-2020:3762-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2020-1971: Fixed a null pointer dereference in EDIPARTYNAME bsc1179491. - Initialized dh-nid to NIDundef in DHnewmethod bsc1177673. - Fixed a test failure in apachessl in fips mode bsc1177793. - Renamed BNgetrfc3526prime functions back...

Apache Groovy Provides Resource Management Error Vulnerability

Apache Groovy is the United States Apache Apache Software Foundation of a Java-based platform for object-oriented programming language, which combines many powerful features of Python, Ruby and Smalltalk. A resource management error vulnerability exists in the Apache Groovy provides product that...

CVE-2020-26960

If the Compact method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...

CVE-2020-26960

If the Compact method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...

CVE-2020-26960

If the Compact method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...

RHEL 7 : mariadb-galera (RHSA-2020:5379)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5379 advisory. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Galera is a synchronous multi-master cluster for...

[ASA-202012-12] blueman: privilege escalation

Arch Linux Security Advisory ASA-202012-12 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-15238 Package : blueman Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1259 Summary ======= The package blueman before versio...

Exploit for CVE-2020-2551

CVE-2020-2551 Weblogic IIOP 反序列化 测试环境 Weblogic10.3.6+jdk1.6 打包好的jar包 提取码：a6ob 漏洞利用 下载jar包，然后使用marshalsec起一个恶意的RMI服务，本地编译一个exp.java java package payload; import java.io.IOException; public class exp public exp String cmd = "curl http://172.16.1.1/success"; try...

December 8, 2020—KB4592438 (OS Builds 19041.685 and 19042.685)

None None...

Vulnerability in CakePHP fixed

The makers of CakePHP have fixed a vulnerability with version 4.0.10 fixed. The security fixes fix a vulnerability in the CsrfProtectionMiddleware that allowed parameters for overwrite method CSRF checks without additional POST data bypassed. CakePHP developers have issued updates to fix the...

CakePHP 4.0.10 Released

CakePHP 4.0.10 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 4.0.10. This release contains security fixes and is a recommended upgrade for all applications still using 4.0.x. The security fixes address a vulnerability in the CsrfProtectionMiddleware tha...

Buffer Overflow

Buffer overflow in the listfiles function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service crash via vectors related to the compression method...

Arcserve D2D getNews XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getNews method. Due to the improper restriction of XML External Entity XXE...