CVE-2020-7718

All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions...

CVE-2020-7715

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function...

Design/Logic Flaw

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function...

CVE-2020-7724

CVE-2020-7724 affects the tiny-conf package: prototype pollution via the set function. Affected versions are all up to and including 1.1.0; no fixed version is available. Documents describe the vulnerability as enabling property pollution on Object.prototype, with potential DoS or broader impact,...

CVE-2020-7715 Prototype Pollution

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function...

CVE-2020-7711

This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

MGASA-2020-0341 Updated chrony package fixes security vulnerability

Chrony's method of opening its PID file could allow a compromised chrony user account to overwrite files in certain parts of the filesystem with chrony's PID, using a symlink attack CVE-2020-14367...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

Command injection

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

Design/Logic Flaw

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function...

Code injection

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution...

CVE-2020-7694

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

CVE-2020-7687

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js...

CVE-2020-15123 Command injection in codecov (npm package)

In codecov npm package before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE CVE-2020-7597 for GHSA-5q88-cjfq-g2mh was...

openSUSE: Security Advisory for python-ipaddress (openSUSE-SU-2020:1002-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE: Security Advisory for LibVNCServer (openSUSE-SU-2020:0978-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-7693

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20. Mitigation There is no mitigation for this issue, the flaw can only be resolved by applying updates...

Code injection

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20...

Fedora: Security Advisory for xpdf (FEDORA-2020-de27bb80af)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-8014

A UNIX Symbolic Link Symlink Following vulnerability in the packaging of kopano-spamd of openSUSE Leap 15.1, openSUSE Tumbleweed allowed local attackers with the privileges of the kopano user to escalate to root. This issue affects: openSUSE Leap 15.1 kopano-spamd versions prior to...