UBUNTU-CVE-2021-3474

There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in the FastHufDecoder, potentially leading to problems with application availability...

AZL-6464 CVE-2020-27779 affecting package grub2 for versions less than 2.06~rc1-7

A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest...

CVE-2020-13462

Insecure Direct Object Reference IDOR exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA...

MantisBT 信息泄露漏洞

MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT versions prior to 2.24.4, which stems from a lack of access checkin...

Cloudbees Jenkins and LTS Authorization Issues Vulnerability (CNVD-2021-04647)

Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . An authorization issue vulnerabilit...

Rust Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust actix-http crate before 2.0.0-alpha.1, which stems from BodyStream having a use-after-free...

Nokogiri 代码问题漏洞

Nokogiri is an open source software library for parsing HTML and XML in Ruby . A code issue vulnerability exists in versions prior to Nokogiri 1.11.0.rc4 that allows access to external resources over the network, potentially leading to XXE or SSRF attacks. No detailed vulnerability details are...

Linux kernel 资源管理错误漏洞

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A post-release reuse vulnerability exists in kernel/trace/ringbuffer.c in versions of Linux kernel prior to 5.10-rc1...

CVE-2020-8749

Out-of-bounds read in subsystem for IntelR AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2020-9257

HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123C432E19R2P5patch02, versions earlier than 10.1.0.126C10E11R5P1, and versions earlier than 10.1.0.160C00E160R2P8 have a buffer overflow vulnerability. The software access data past the end, or before the beginning, of the intended...

FreeBSD : MySQL -- Multiple vulnerabilities (0ed71663-c369-11ea-b53c-d4c9ef517024)

Oracle reports : This Critical Patch Update contains 40 new security patches for Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The highest CVSS v3.1 Base Score of vulnerabiliti...

MySQL -- Multiple vulnerabilities

Oracle reports: This Critical Patch Update contains 40 new security patches for Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The highest CVSS v3.1 Base Score of vulnerabilitie...

Ruby on Rails Code Issues Vulnerabilities

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A security vulnerability exists in Ruby on Rails versions prior to 5.2.4.2 and 6.0.3.1. An attacker can exploit this vulnerability by modifying the 'Content-Length' field of the file upload URL ...

CVE-2020-1808

Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions earlier than 10.0.0.187C00E60R4P11; versions earlier than 10.0.0.187C00E60R4P11; versions earlier than 10.0.0.176C00E60R2P11;9.1.0.135C00E133R2P1; versions earlier than...

PT-2020-6214 · Openexr +7 · Openexr +7

Name of the Vulnerable Software and Affected Versions: OpenEXR versions prior to 2.4.1 Description: An issue in OpenEXR is related to an out-of-bounds write in the copyIntoFrameBuffer function in ImfMisc.cpp. This can potentially allow a remote attacker to cause a denial of service...

aws-lambda operating system command injection vulnerability

AWS-Lambda is a computing service that runs code without pre-configured or managed servers. An operating system command injection vulnerability exists in versions of aws-lambda prior to 1.0.5, which stems from a program that fails to perform any cleanup operations before using config.FunctioName ...

Oracle Ties Previous All-Time Patch High with January Updates

Oracle has patched 334 vulnerabilities across all of its product families in its January 2020 quarterly Critical Patch Update CPU. Out of these, 43 are critical/severe flaws carrying CVSS scores of 9.1 and above. The CPU ties for Oracle’s previous all-time high for number of patches issued, in Ju...

Halo Code Issue Vulnerability

Halo is a personal blogging system. A security vulnerability exists in Halo versions prior to 1.2.0-beta.1. An attacker can exploit the vulnerability to execute commands...

Apple Opens Its Invite-Only Bug Bounty Program to All Researchers

As promised by Apple in August this year, the company today finally opened its bug bounty program to all security researchers, offering monetary rewards to anyone for reporting vulnerabilities in the iOS, macOS, watchOS, tvOS, iPadOS, and iCloud to the company. Since its launch three years ago,...

Apple will now pay hackers up to $1 million for reporting vulnerabilities

Apple has just updated the rules of its bug bounty program by announcing a few major changes during a briefing at the annual Black Hat security conference yesterday. One of the most attractive updates is… Apple has enormously increased the maximum reward for its bug bounty program from $200,000 t...