PT-2020-6427 · Privoxy +3 · Privoxy +3

Name of the Vulnerable Software and Affected Versions: Privoxy versions prior to 3.0.29 Description: A memory leak issue was found in the show-status CGI handler when no action files are configured. This issue can be exploited by a remote attacker to cause a denial of service. Recommendations: Fo...

PT-2020-6548 · Unknown +1 · F2Fs-Tools +1

Name of the Vulnerable Software and Affected Versions: F2fs-Tools F2fs.Fsck version 1.13 Description: An exploitable information disclosure issue exists in the dev read functionality. A specially crafted f2fs filesystem can cause an uninitialized read, resulting in information disclosure. An...

Sandbox Breakout / Arbitrary Code Execution in safe-eval

All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system. Evaluating the payload js function var ex = new Error...

Debian DLA-2336-1 : firejail security update

Tim Starling discovered two vulnerabilities in firejail, a sandbox program to restrict the running environment of untrusted applications. CVE-2020-17367 It was reported that firejail does not respect the end-of-options separator '--', allowing an attacker with control over the command line option...

PT-2020-6513 · D Link · D-Link Dap-2020

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2020 version 1.01rc001 Description: The issue is related to a buffer overflow on the stack in the webproc getpage scenario of the D-Link DAP-2020 Wi-Fi access point's firmware. This can be exploited by network-adjacent attackers to...

PT-2020-15741

Name of the Vulnerable Software and Affected Versions voidtools Everything versions prior to 1.4.1 Beta Nightly 2020-08-18 Description The issue allows privilege escalation via a Trojan horse urlmon.dll file in the installation directory. This is only relevant if low-privileged users can write to...

PT-2020-14229 · Openmage · Openmage

Name of the Vulnerable Software and Affected Versions: OpenMage versions prior to 19.4.6 OpenMage versions prior to 20.0.2 Description: This issue allows attackers to circumvent the fromkey protection in the Admin Interface, increasing the attack surface for Cross Site Request Forgery attacks...

PT-2020-13792 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions prior to 8.6.0 Description: The issue is related to the Replication handler, which allows commands such as backup, restore, and deleteBackup. These commands take a location parameter that was not validated, allowing...

PT-2020-6461

Name of the Vulnerable Software and Affected Versions QEMU version 5.0.0 Description The issue is related to the hw/usb/hcd-ohci.c component in the QEMU hardware emulator, which can lead to an infinite loop when a TD list has a loop. This can cause a denial of service. Recommendations For QEMU...

Laravel Telescope Information Disclosure Vulnerability

Laravel Telescope is erroneously publicly accessible. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:laravel:telescope"; if...

PT-2020-5832 · Jenkins · Jenkins Flaky Test Handler Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Flaky Test Handler Plugin versions 1.0.4 and earlier Description: The issue is related to a cross-site request forgery CSRF vulnerability in the "Deflake this build" feature of the Jenkins Flaky Test Handler Plugin. This vulnerability...

PT-2020-6943 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions prior to 4.0.8 Redmine versions 4.1.x prior to 4.1.2 Description: The issue is related to permission handling errors in the Redmine project and task management web application. Exploitation of this issue allows a remote...

PT-2020-3815 · Microsoft · Office +1

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Microsoft Office affected versions not specified Description: An information disclosure issue exists due to improper handling of objects in memory by Microsoft Excel. This could allow an attacke...

PT-2020-3670 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a buffer overflow in memory, allowing an attacker to disclose protected information using a specially crafted application. An authenticated attacker could exploit th...

PT-2020-3979 · Microsoft · Dynamics 365

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 on-premises affected versions not specified Description: A cross-site scripting issue exists due to insufficient protection of the web page structure. This could allow a remote attacker to perform cross-site scripting...

Debian DSA-4742-1 : firejail - security update

Tim Starling discovered two vulnerabilities in firejail, a sandbox program to restrict the running environment of untrusted applications. - CVE-2020-17367 It was reported that firejail does not respect the end-of-options separator '--', allowing an attacker with control over the command line...

PT-2020-14807 · Advantech · Advantech Webaccess Hmi Designer

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess HMI Designer versions 2.1.9.31 and prior Description: The issue is related to multiple heap-based buffer overflow vulnerabilities. These vulnerabilities can be exploited by opening specially crafted project files, which ma...

PT-2020-14189 · Etcd +4 · Etcd +4

Name of the Vulnerable Software and Affected Versions: etcd versions 3.3.0 through 3.3.22 etcd versions 3.4.0 through 3.4.9 Description: The issue is related to a lack of validation on the size of a record stored in the length field of a WAL file. This allows for the creation of a forged, extreme...

PT-2020-16951 · Maxmind +8 · Libmaxminddb +8

Name of the Vulnerable Software and Affected Versions: libmaxminddb versions prior to 1.4.3 Description: The issue is a heap-based buffer over-read in the dump entry data list function in maxminddb.c. This occurs in libmaxminddb before version 1.4.3. Recommendations: For versions prior to 1.4.3,...

Delta Industrial Automation CNCSoft ScreenEditor

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Delta Electronics Equipment: Industrial Automation CNCSoft ScreenEditor Vulnerabilities: Stack-based Buffer Overflow, Out-of-bounds Read, Access of Uninitialized Pointer 2. RISK EVALUATION Successful exploitation of...