2263 matches found
CVE-2020-28464
This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine...
CVE-2020-7771
The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function...
Fedora: Security Advisory for mbedtls (FEDORA-2020-e2d7a16ae9)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for gdm (EulerOS-SA-2020-2511)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for sox (EulerOS-SA-2020-2565)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Command injection
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
CVE-2020-7791
CVE-2020-7791 affects the i18n package before 2.1.15. Root cause: insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs. Impact: Denial of service ( DoS ), including a null pointer dereference per Veracode reference, with condi...
CVE-2020-7793
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
PT-2020-17272 · Alt +3 · Alt Linux +2
Name of the Vulnerable Software and Affected Versions: ALT Linux affected versions not specified Description: The issue concerns a package vulnerability in ALT Linux. No specific details about the vulnerability, affected devices, or real-world incidents are provided. Recommendations: At the momen...
Input validation
This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is cause...
Code injection
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...
Design/Logic Flaw
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program...
CVE-2020-7772
This affects the package doc-path before 2.1.2...
Design/Logic Flaw
This affects the package doc-path before 2.1.2...
MGASA-2020-0420 Updated arpwatch package fixes a security vulnerability
A buffer overflow from long hostnames. rhbz1563939...
CVE-2020-7769
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails...
Oracle Linux 8 : targetcli (ELSA-2020-4697)
The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-4697 advisory. 2.1.53-1 - Update to new upstream version 2.1.52-1 - Update to new upstream version Tenable has extracted the preceding description block directly from the Orac...
Design/Logic Flaw
All versions of package express-validators are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls...