14151 matches found
Information Disclosure
github.com/hashicorp/vault is vulnerable to information disclosure. The vulnerability is possible because the error messages returned by the LDAP auth methold allows user enumeration...
PT-2020-15255
Name of the Vulnerable Software and Affected Versions WeiPHP version 5.0 Description The issue is related to improper access restriction to pages in WeiPHP, specifically when using the POST method. Recommendations For WeiPHP version 5.0, consider restricting access to sensitive pages to minimize...
CVE-2020-35177
HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1...
PT-2020-17273
Name of the Vulnerable Software and Affected Versions HashiCorp Vault and Vault Enterprise versions 1.4.1 through 1.5.5 HashiCorp Vault and Vault Enterprise versions 1.6.0 Description The issue allows the enumeration of users via the LDAP auth method. It is estimated that a significant number of...
mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrepsstmethod allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and...
CVE-2020-0500
In startInputUncheckedLocked of InputMethodManager.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...
mariadb:10.3 security, bug fix, and enhancement update
An update is available for Judy. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list MariaDB is a multi-user, multi-threaded SQL database server that is binary...
ALSA-2020:5500 Important: mariadb:10.3 security, bug fix, and enhancement update
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb 10.3.27, galera 25.3.31. BZ1899082, BZ1899086 Security Fixes: mariadb: Insufficient SST method name check leading to cod...
Sogou Input Method (Windows client) suffers from dll hijacking vulnerability
Sogou Input Method is a Chinese character input method tool launched in June 2006 by Sogou Sogou. A dll hijacking vulnerability exists in Sogou Input Method Windows client. An attacker can exploit this vulnerability to load a malicious dll and execute malicious code...
CVE-2020-35175
Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...
CVE-2020-35175
Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...
CVE-2020-35175
CVE-2020-35175 affects Frappe Framework 12 and 13 where the vulnerability lies in the frappe.client API not properly validating the HTTP method . The root cause is stated as a method validation issue within that API. The connected documents corroborate the same details across multiple sources (NV...
CVE-2020-35175
Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...
SUSE-SU-2020:3762-1 Security update for openssl-1_0_0
This update for openssl-100 fixes the following issues: - CVE-2020-1971: Fixed a null pointer dereference in EDIPARTYNAME bsc1179491. - Initialized dh-nid to NIDundef in DHnewmethod bsc1177673. - Fixed a test failure in apachessl in fips mode bsc1177793. - Renamed BNgetrfc3526prime functions back...
CVE-2020-35175: Undefined Security Weakness
Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API...
PT-2020-17271
Name of the Vulnerable Software and Affected Versions Frappe Framework versions 12 and 13 Description The issue is related to the improper validation of the HTTP method for the frappe.client API. This could potentially allow for unauthorized actions. Recommendations For Frappe Framework version 1...
Apache Groovy Provides Resource Management Error Vulnerability
Apache Groovy is the United States Apache Apache Software Foundation of a Java-based platform for object-oriented programming language, which combines many powerful features of Python, Ruby and Smalltalk. A resource management error vulnerability exists in the Apache Groovy provides product that...
CVE-2020-26960
If the Compact method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...
CVE-2020-26960
If the Compact method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...
CVE-2020-26960
If the Compact method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...