PT-2020-16799 · Mozilla +4 · Thunderbird +4

Name of the Vulnerable Software and Affected Versions: xdg-utils versions 1.1.0-rc1 and newer Description: A flaw was found in the xdg-email component. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could...

AZL-6774 CVE-2020-26572 affecting package opensc for versions less than 0.22.0-1

The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcosdecipher...

CVE-2020-26571

The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in scpkcs15emugemsafeGPKinit...

CVE-2020-24717

CVE-2020-24717 affects OpenZFS prior to 2.0.0-rc1 when used on FreeBSD, where group permissions are misinterpreted as user permissions, making mode 0770 effectively as permissive as 0777. The Red Hat advisory and other listings confirm OpenZFS on FreeBSD as the affected context. The vulnerability...

A heap use-after-free vulnerability was found in systemd before version v245-rc1 where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges by sending specially crafted dbus messages.

...

Cross site request forgery (csrf)

It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery CSRF which is exploitable in cases where preflight checks are not instigated or bypassed. For example authorised users using an older browser with Adobe Flash are vulnerable when targeted by an attacker. This...

LibRaw Input Validation Error Vulnerability

LibRaw is a C++ library from the LibRaw team for processing RAW CRW/CR2, NEF, RAF, DNG, andothers format images. An input validation error vulnerability exists in versions prior to LibRaw 0.20-RC1, which stems from the program failing to check the size of thumbnails. A remote attacker could explo...

CVE-2020-15503

LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpackthumb.cpp, postprocessing/memimage.cpp, and utils/thumbutils.cpp. For example, mallocsizeoflibrawprocessedimaget+T.tlength occurs without validating T.tlength...

CVE-2020-15503

LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpackthumb.cpp, postprocessing/memimage.cpp, and utils/thumbutils.cpp. For example, mallocsizeoflibrawprocessedimaget+T.tlength occurs without validating T.tlength...

FreeBSD : znc -- Authenticated users can trigger an application crash (10a24ce0-ab68-11ea-b9b8-641c67a117d8)

Mitre reports : ZNC 1.8.0 up to 1.8.1-rc1 allows attackers to trigger an application crash with a NULL pointer dereference if echo-message is not enabled and there is no network. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBS...

ZNC Code Issue Vulnerability

ZNC is a set of IRC proxies that allow users to log in to IRC servers from their workstations. A code issue vulnerability exists in ZNC 1.8.0 and later fixed in version 1.8.1-rc1. An attacker can exploit this vulnerability to cause the application to crash when echo-message is not enabled and no...

PT-2020-13674 · Znc · Znc

Name of the Vulnerable Software and Affected Versions: ZNC versions 1.8.0 through 1.8.1-rc1 Description: The issue allows authenticated users to trigger an application crash with a NULL pointer dereference if echo-message is not enabled and there is no network. This can be exploited by attackers ...

Cross-site Scripting (XSS)

Overview lazysizes is a fast jank-free, SEO-friendly and self-initializing lazyloader for images including responsive images picture/srcset, iframes, scripts/widgets and much more. It also prioritizes resources by differentiating between crucial in view and near view elements to make perceived...

Argo Information Disclosure Vulnerability

Argo is an open source container native workflow engine. A security vulnerability exists in versions prior to Argo 1.5.0-rc1. An attacker can exploit the vulnerability by submitting a request to invoke the API to retrieve information...

CVE-2018-21034

CVE-2018-21034 affects Argo CD (and Argo) where authenticated users can submit API calls to retrieve secrets and other manifests stored in git. Root cause: insufficient access control enabling information disclosure via API requests. Impact: exposure of secrets and manifests stored in git. Affect...

CVE-2020-1712

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by...

CVE-2020-1712

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by...

CVE-2020-1712

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by...

Race condition

The Linux kernel before 2.4.36-rc1 has a race condition. It was possible to bypass systrace policies by flooding the ptraced process with SIGCONT signals, which can can wake up a PTRACED process...

CVE-2007-4774

The Linux kernel before 2.4.36-rc1 has a race condition. It was possible to bypass systrace policies by flooding the ptraced process with SIGCONT signals, which can can wake up a PTRACED process...