thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data...

Error - "An Unexpected MAPI Error Occurred. Index Was Out of Range. Must Be Non-Negative and Less Than the Size of the Collection."

In a multi-domain environment, user account from a different domain than the one PVS environment is on is unable to open PVS console, getting error "An unexpected MAPI error occurred." Index was out of range. Must be non-negative and less than the size of the collection. Parameter name: index."...

NaviServer Denial of Service Vulnerability

NaviServer is a high-performance Web server written in C and Tcl. A denial of service vulnerability exists in NaviServer versions 4.99.4 through 4.99.19. The vulnerability stems from the nsd/driver.c ChunkedDecode function failing to properly validate the length of a chunk. A remote attacker coul...

DEBIAN-CVE-2020-11523

libfreerdp/gdi/region.c in FreeRDP versions 1.0 through 2.0.0-rc4 has an Integer Overflow...

UBUNTU-CVE-2020-11523

libfreerdp/gdi/region.c in FreeRDP versions 1.0 through 2.0.0-rc4 has an Integer Overflow...

CVE-2020-12831

CVE-2020-12831 affects FRRouting FRR up to 7.3.1. The issue arises when using the split-config feature: the init script creates an empty config file with world-readable permissions, enabling potential information leakage via tools/frr.in and tools/frrcommon.sh.in. Some sources label this as user ...

GLSA-202005-01 : Long Range ZIP: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202005-01 Long Range ZIP: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Long Range ZIP. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to...

IBM API Connect Information Disclosure Vulnerability (CNVD-2020-31096)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. An information disclosure vulnerability exists in the management server in IBM API Connect...

Long Range ZIP: Multiple vulnerabilities

Background Optimized for compressing large files Description Multiple vulnerabilities have been discovered in Long Range ZIP. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted archive file possibly resulting in...

ASSA ABLOY Yale WIPC-301W Operating System Command Injection Vulnerability

The ASSA ABLOY Yale WIPC-301W is a home webcam from the Swedish ASSA ABLO Group. A security vulnerability exists in the ASSA ABLOY Yale WIPC-301W versions 2.x.2.29 through 2.x.2.43p1. An attacker can exploit the vulnerability to inject commands...

CVE-2020-10176

ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43p1 devices allow Eval Injection of commands...

IBM WebSphere Application Server Liberty Authorization Issues Vulnerability

IBM WebSphere Application Server Liberty is a U.S. IBM company built on the Open Liberty project on top of the Java application server . An authorization issue vulnerability exists in IBM WebSphere Application Server Liberty versions 19.0.0.5 through 20.0.0.4, which can be exploited by an attacke...

WordPress Access Restriction Bypass Vulnerability (CNVD-2020-27079)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress versions 3.7 through 5.4, which stems from the fact that a passwo...

NetFortris Fonality Trixbox endpoint_devicemap.php Component OS Command Injection Vulnerability

NetFortris Fonality Trixbox is a suite of business telephony software from NetFortris USA. An operating system command injection vulnerability exists in the endpointdevicemap.php component in NetFortris Fonality Trixbox Community Edition versions 1.2.0 through 2.8.0.4, which can be exploited by a...

CVE-2020-1631

creationtimestamp| type| source ---|---|--- 2020-04-30 10:30:02+00:00| seen| https://t.me/SecLabNews/7490 2020-10-13 06:50:38+00:00| seen| MISP/453274cf-e60d-452a-b88e-0bf6a5a6dae4 2020-10-13 15:16:18+00:00| seen| MISP/f628d96f-2958-4717-91da-e86aace4925d 2023-06-14 21:10:04+00:00| seen|...

GitLab Cross-Site Scripting Vulnerability (CNVD-2020-27233)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in the Admin...

UBUNTU-CVE-2020-11020

Faye NPM, RubyGem versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It...

PT-2020-13089 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 9.5.9 through 12.9 Description: The issue concerns a stored XSS vulnerability in an admin notification feature. This allows for malicious code to be stored and executed when the notification is viewed by an administrator...

PT-2020-13090 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.8 through 12.9 Description: The issue allows someone to mirror a repository even if the feature is not activated. Recommendations: For GitLab versions 10.8 through 12.9, update to a version that contains a fix for this issu...

kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS

A flaw was found in the Linux kernel’s implementation of the WiFi station handoff code. An attacker within the radio range could use this flaw to deny a valid device from joining the access point...