7645 matches found
CVE-2020-9788
The CVE-2020-9788 entry describes a validation/input sanitization issue in macOS where a file may be rendered in a way that could execute JavaScript. The vulnerability is addressed in macOS Catalina 10.15.5, with Apple noting improved input sanitization as the fix. Public references also align wi...
Security Vulnerabilities fixed in Firefox 77 — Mozilla
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. Mozilla Developer Iain Ireland...
Gitlab -- Multiple Vulnerabilities
Gitlab reports: User Email Verification Bypass OAuth Flow Missing Email Verification Checks Notification Email Verification Bypass Undisclosed Vulnerability on a Third-Party Rendering Engine Group Sign-Up Restriction Bypass Mirror Project Owner Impersonation Missing Permission Check on Fork...
openSUSE Security Update : freetype2 (openSUSE-2020-704)
This update for freetype2 to version 2.10.1 fixes the following issues : Security issue fixed : - CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c bsc1079603. Non-security issues fixed : - Update to version 2.10.1 - The bytecode hinting of OpenType variation fonts was flawed, sinc...
Security update for freetype2 (moderate)
openSUSE Security Update: Security update for freetype2 Announcement ID: openSUSE-SU-2020:0704-1 Rating: moderate References: 1079603 1091109 Cross-References: CVE-2018-6942 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has one errata is now available...
SUSE SLED15 / SLES15 Security Update : freetype2 (SUSE-SU-2020:1353-1)
This update for freetype2 to version 2.10.1 fixes the following issues : Security issue fixed : CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c bsc1079603. Non-security issues fixed : Update to version 2.10.1 - The bytecode hinting of OpenType variation fonts was flawed, since th...
Cross-Site Scripting (XSS)
dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The $attachment variable in \htdocs\document.php prompts for the open/save dialogue box when it is set to true. A remote attacker is able to modify the parameter to false and cause the file is to be rendered in a user's browser...
UBUNTU-CVE-2020-13239
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...
SUSE-SU-2020:1353-1 Security update for freetype2
This update for freetype2 to version 2.10.1 fixes the following issues: Security issue fixed: - CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c bsc1079603. Non-security issues fixed: - Update to version 2.10.1 The bytecode hinting of OpenType variation fonts was flawed, since the...
PT-2020-13389 · Dolibarr · Dolibarr
Name of the Vulnerable Software and Affected Versions: Dolibarr version 11.0.4 Description: The issue concerns the DMS/ECM module, which renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link, leading to a Cross-Site Scripting XSS...
SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2020:1211-1)
This update for webkit2gtk3 fixes the following issues : Security issue fixed : CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed : Update to version 2.28.2 bsc1170643 : + Fix excessive CPU usage due to GdkFrameClock...
openSUSE Security Update : webkit2gtk3 (openSUSE-2020-646)
This update for webkit2gtk3 fixes the following issues : Security issue fixed : - CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed : - Update to version 2.28.2 bsc1170643 : + Fix excessive CPU usage due to...
SUSE-SU-2020:1211-1 Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues: Security issue fixed: - CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed: - Update to version 2.28.2 bsc1170643: + Fix excessive CPU usage due to GdkFrameClock...
The vulnerability of the WordPress website content management system, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise the integrity of data.
The vulnerability of the WordPress content management system’s functions is related to an error in the execution of XSS attacks during shortcode rendering. Exploiting this vulnerability allows a remote attacker to compromise data integrity...
Fedora 31 : webkit2gtk3 (2020-7f34d2cfd8)
Update to 2.28.2 : - Fix excessive CPU usage due to GdkFrameClock not being stopped. - Fix UI process crash when EGLWLbindwaylanddisplay extension is not available. - Fix position of select popup menus in X11. - Fix playing of Youtube live stream/H264 URLs. - Fix several crashes and rendering...
SUSE-SU-2020:1198-1 Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues: Security issue fixed: - CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed: - Update to version 2.28.2 bsc1170643: + Fix excessive CPU usage due to GdkFrameClock...
[SECURITY] Fedora 31 Update: webkit2gtk3-2.28.2-1.fc31
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3...
[SECURITY] Fedora 30 Update: webkit2gtk3-2.28.2-1.fc30
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3...
Fedora 30 : webkit2gtk3 (2020-bd170e803f)
Update to 2.28.2 : - Fix excessive CPU usage due to GdkFrameClock not being stopped. - Fix UI process crash when EGLWLbindwaylanddisplay extension is not available. - Fix position of select popup menus in X11. - Fix playing of Youtube live stream/H264 URLs. - Fix several crashes and rendering...