CVE-2020-5617

Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unauthorized privileges and modify/obtain sensitive information or perform unintended operations via unspecified vectors...

ASB-A-157598956

In stopZygoteLocked of AppZygote.java, there is an insufficient cleanup. This could lead to local information disclosure in the application that is started next with no additional execution privileges needed. User interaction is not needed for exploitation...

@biesbjerg/ng2-translate-extract (>=0.5.0, <=0.6.0), @biesbjerg/ngx-translate-extract (>=1.0.0, <=2.3.4) +67 more potentially affected by CVE-2020-36632 via flat (>=2.0.0, <=2.0.1)

flat NPM version =2.0.0, =0.5.0, =1.0.0, =9.16.1-rc.0, =0.0.1, =0.0.2-beta1, =1.2.7, =2.1.27, =2.0.7, =1.1.9, =2.3.4-atknatk.1, =0.0.1, =1.0.0, =1.0.0, =2.3.4, =2.3.5, =2.3.6 and more Source cves: CVE-2020-36632 Source advisory: SNYK:JS-FLAT-596927...

3dcore-lib (0.17.9), @0xcert/client (>=1.0.0-beta, <=1.0.2) +1562 more potentially affected by CVE-2020-13822 via elliptic (>=6.0.2, <=6.5.2)

elliptic NPM version =6.0.2, =1.0.0-beta, =0.1.0, =0.0.0-alpha10, =2.0.0-alpha10, =2.0.0-alpha10, =1.0.0, =1.5.1, =2.0.0-alpha0, =0.0.0-alpha10, =0.0.0-alpha10, =0.0.0-alpha10, =0.0.0-alpha10, =0.0.0-alpha10, =0.0.0-alpha10, =2.1.1 and more Source cves: CVE-2020-13822 Source advisory:...

CVE-2020-4644

IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

jackson-databind: Lacks certain xbean-reflect/JNDI blocking

A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availabili...

MySQL Enterprise Monitor 4.x < 4.0.10 / 8.x < 8.0.15 DoS (Jul 2019 CPU)

A denial of service DoS vulnerability exists in MySQL Enterprise Monitor due the use of a vulnerable Spring Framework version. Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for rang...

springframework: DoS Attack via Range Requests

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...

IBM QRadar SIEM Carbon Black Response Cross-Site Scripting Vulnerability

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, etc. Carbon Black Response i...

Amazon Linux 2 : libxml2 (ALAS-2020-1466)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1466 advisory. A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 when...

Unspecified Vulnerability in Sylabs Singularity (CNVD-2020-52438)

Singularity is a Linux-based container platform for running standalone applications. A security vulnerability exists in Sylabs Singularity versions 3.0 through 3.5. An attacker can exploit the vulnerability to bypass ECL protection...

CVE-2020-14563

Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications component: WebGUI. Supported versions that are affected are 3.0.0-3.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

Unspecified Vulnerability in Oracle Primavera Portfolio Management (CNVD-2020-52050)

Primavera Portfolio Management is a software solution for advising, planning, controlling and strategically analyzing your portfolio. A security vulnerability exists in the Web Server component in Primavera Portfolio Management 16.1.0.0-16.1.5.1, 18.0.0.0-18.0.2.0, 19.0.0.0. An attacker could...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2020-44273)

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, etc. Advanced Outbound Telephony is one of the tools used for outbound ca...

Appweb Null Pointer Dereference Vulnerability

Appweb is a web server for embedded applications. Appweb suffers from a null pointer dereference vulnerability. The vulnerability stems from the fact that Appweb, which supports CGI, does not properly handle HTTP requests with a Range header that lacks an exact range. An attacker could exploit th...

CVE-2020-15689

Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service...

CVE-2020-15689

Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service...

CVE-2020-15689

CVE-2020-15689 affects Appweb prior to 7.2.2 and 8.x prior to 8.1.0 when built with CGI support. A crafted HTTP Range header lacking an exact range can cause a NULL pointer dereference, leading to a denial of service. Impact is described as a crash/DoS without additional exploitation details in t...

CVE-2020-15689

Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service...

PT-2020-14586 · Embedthis · Appweb

Name of the Vulnerable Software and Affected Versions: Appweb versions prior to 7.2.2 Appweb versions 8.x prior to 8.1.0 Description: The issue arises when Appweb, built with CGI support, fails to properly handle an HTTP request containing a Range header without an exact range. This mishandling c...