2196 matches found
EulerOS 2.0 SP3 : bash (EulerOS-SA-2020-2081)
According to the version of the bash package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in disableprivmode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to...
CVE-2020-7735
The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option...
CVE-2020-7730 Command Injection
The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param...
CVE-2020-7729
The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...
CVE-2020-7729 Arbitrary Code Execution
The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...
Directory Traversal in peiserver
Affected versions of peiserver resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system. Example...
GHSA-7WW4-C3MJ-93CF Downloads Resources over HTTP in pm2-kafka
Affected versions of pm2-kafka insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syst...
CVE-2020-7669
This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction...
CVE-2020-7666
The CVE-2020-7666 entry concerns github.com/u-root/u-root/pkg/cpio, where the cpio extraction code is vulnerable to path traversal (leading and non-leading relative paths) and symlink-based traversal (relative and absolute) during archive extraction. Multiple sources describe this as Arbitrary Fi...
CVE-2020-7725
All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function...
CVE-2020-7722
All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function...
CVE-2020-7715
All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function...
CVE-2020-7718
All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions...
Design/Logic Flaw
All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function...
CVE-2020-7724
CVE-2020-7724 affects the tiny-conf package: prototype pollution via the set function. Affected versions are all up to and including 1.1.0; no fixed version is available. Documents describe the vulnerability as enabling property pollution on Object.prototype, with potential DoS or broader impact,...
CVE-2020-7715 Prototype Pollution
All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function...
CVE-2020-7711
This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...
MGASA-2020-0341 Updated chrony package fixes security vulnerability
Chrony's method of opening its PID file could allow a compromised chrony user account to overwrite files in certain parts of the filesystem with chrony's PID, using a symlink attack CVE-2020-14367...