CVE-2020-15239: Improper Limitation of a Pathname to a Restricted Directory

In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a .data suffix and which are accompanied by a JSON file with the .meta suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of...

PT-2020-14304

Name of the Vulnerable Software and Affected Versions xmpp-http-upload versions prior to 0.4.0 Description The issue allows attackers to read files with a .data suffix and accompanied by a JSON file with the .meta suffix when the GET method is attacked. This can lead to Information Disclosure and...

PT-2020-6188 · Mariadb +8 · Mariadb +9

Name of the Vulnerable Software and Affected Versions: mariadb versions prior to 10.1.47 mariadb versions prior to 10.2.34 mariadb versions prior to 10.3.25 mariadb versions prior to 10.4.15 mariadb versions prior to 10.5.6 Description: The issue is related to errors in input data processing duri...

DEBIAN-CVE-2020-26137

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

ALPINE-CVE-2020-26137

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

PYSEC-2020-148

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

PYSEC-2020-148

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

CVE-2020-13952: Undefined Security Weakness

In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the...

UBUNTU-CVE-2020-26137

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

ESMPRO Manager Code Execution

The vulnerability of the RMI file manager ESMPRO Manager is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2020-26137

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

CVE-2020-26137: Improper Neutralization of Special Elements in Output Used by a Downstream Component

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

PSF-2020-5 http.client: HTTP Header Injection in the HTTP method

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request...

Security update for singularity (moderate)

openSUSE Security Update: Security update for singularity Announcement ID: openSUSE-SU-2020:1529-1 Rating: moderate References: 1176705 1176707 Cross-References: CVE-2020-25039 CVE-2020-25040 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes two vulnerabilities is now availabl...

PT-2020-17527 · Rust · Stack Crate

Name of the Vulnerable Software and Affected Versions: stack crate versions prior to 0.3.1 Description: The issue is related to the ArrayVec in the stack crate, where the insert method allows insertion of an element into the array object at a specified index. Due to a missing check on the upper...

CVE-2020-24626

Unathenticated directory traversal in the ReceiverServlet class doPost method can lead to arbitrary remote code execution in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-24625

Summary: CVE-2020-24625 is an unauthenticated directory traversal vulnerability in the ReceiverServlet doGet() of Hewlett Packard Enterprise Pay per Use (PPU) Utility Computing Service (UCS) Meter, up to version 1.9 (vulnerability exists prior to 1.9). The root cause is lack of proper validation ...

$this->validate() returns all properties, not just validated ones

IMPORTANT BUGFIX $this-validate usually only returns the validated dataset, however a regression was introduced, that caused it to return ALL data on the Livewire component. 1659...

$this->validate() returns all properties, not just validated ones

IMPORTANT BUGFIX $this-validate usually only returns the validated dataset, however a regression was introduced, that caused it to return ALL data on the Livewire component. 1659...

njs:njs_process_script_fuzzer: Heap-buffer-overflow in njs_string_prototype_repeat

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=5096859524399104 Project: njs Fuzzing Engine: afl Fuzz Target: njsprocessscriptfuzzer Job Type: aflasannjs Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 10 Crash Address: 0x6230000019c8 Crash State:...