The vulnerability of the SiTex distributed application development platform, related to insufficient verification of access rights, allows a perpetrator to disclose protected information.

The vulnerability of the SiTex distributed application development platform is related to insufficient verification of user access rights to data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose protected information...

EulerOS Virtualization for ARM 64 3.0.2.0 : unzip (EulerOS-SA-2020-1222)

According to the versions of the unzip package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service infinite loop via empty bzip2 data in a ZIP...

The vulnerability of the cipher/elgamal.c component of the Libgcrypt cryptographic library, which allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the cipher/elgamal.c component of the Libgcrypt cryptographic library is related to the use of cryptographic algorithms that contain vulnerabilities or risks. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

The vulnerability of the Windows Telephony Service in Windows operating systems stems from errors in memory object handling, which allows an attacker to exploit the system to disclose protected information through a specially created application.

The vulnerability of the Windows Telephony Service in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created application...

(Pwn2Own) Xiaomi GetApps Intent Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Xiaomi GetApps. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

The vulnerability of Cisco Webex Meetings software, related to lack of access control, allows a intruder to connect to a password-protected meeting.

The vulnerability of Cisco Webex Meetings software is related to lack of access control. Exploiting this vulnerability allows a malicious actor to connect to a password-protected meeting, by entering a known meeting ID or the URL address of the meeting through a mobile browser...

UBUNTU-CVE-2019-12441

An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control...

CVE-2019-12441

An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control...

CVE-2019-12441

GitLab Community and Enterprise Edition versions 8.4–11.11 include an access control flaw in the protected branches feature that permits bypassing the protected-branch restriction rules. Root cause is Incorrect Access Control. Impact is partial integrity exposure (bypass of protections) without d...

CVE-2019-12441

Removed by vendor...

CVE-2019-10706

Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used to validate this digest is present in a protected area of the device, and if extracted could be used to install arbitrary firmware to othe...

CVE-2019-10706

Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used to validate this digest is present in a protected area of the device, and if extracted could be used to install arbitrary firmware to othe...

The vulnerability of the win32k component of the Windows operating system, which allows a hacker to disclose protected information

The vulnerability of the win32k component in the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose the protected information...

The vulnerability of the Windows Common Log File System (CLFS) driver in the Windows operating system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Windows Common Log File System CLFS driver in the operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created application...

The vulnerability of the Windows operating system’s kernel, which allows a hacker to disclose protected information

The vulnerability of the Windows operating system’s kernel is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created application...

CKEditor cross-site scripting vulnerability (CNVD-2020-16705)

CKEditor is an open source WYSIWYG text editor specialized for use on web pages. A cross-site scripting vulnerability exists in the "HTML Data Processor" in CKEditor. The vulnerability can be exploited by remote attackers to inject arbitrary web scripts via specially crafted "protected" comments...

UBUNTU-CVE-2020-9281

A cross-site scripting XSS vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment with the ckeprotected syntax...

CVE-2020-9281

A cross-site scripting XSS vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment with the ckeprotected syntax...

CVE-2020-9281

A cross-site scripting XSS vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment with the ckeprotected syntax...

The vulnerability of the OpenId Connect service’s framework for Apache CXF allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the OpenId Connect service for Apache CXF web services is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...