PT-2020-13173 · Calibre · Calibre-Web

Name of the Vulnerable Software and Affected Versions: Calibre-Web version 0.6.6 Description: The issue allows authentication bypass due to a hardcoded secret key 'A0Zr98j/3yX RXHH!jmNLWX/,?RT'. Recommendations: For Calibre-Web version 0.6.6, update the secret key to a unique and secure value to...

PT-2020-15041 · Istio · Istio

Name of the Vulnerable Software and Affected Versions: Kiali versions 0.4.0 through 1.15.0 Description: The issue is related to insufficient JWT validation, allowing a remote attacker to steal a valid JWT cookie and use it to spoof a user session. This could potentially grant privileges to view a...

PT-2020-5588 · Fortinet · Fortivoiceentreprise +1

Name of the Vulnerable Software and Affected Versions: FortiMail versions 5.4.10 and earlier, 6.0.7 and earlier, 6.2.2 and earlier FortiVoiceEntreprise versions 6.0.0 and 6.0.1 Description: The issue is related to weaknesses in the authentication procedure of the email protection system. It may...

PT-2020-8631 · Jquery · Jquery

Name of the Vulnerable Software and Affected Versions: jQuery version 2.2.2 Description: The issue allows for cross-site scripting XSS attacks via a crafted onerror attribute of an IMG element. Recommendations: For jQuery version 2.2.2, consider disabling the use of the onerror attribute in IMG...

PT-2020-6939 · Unknown +4 · Sane-Backends +4

Name of the Vulnerable Software and Affected Versions: SANE Backends versions prior to 1.0.30 Description: The issue is related to a NULL pointer dereference error in the SANE Backends implementation. This can be exploited by a malicious device connected to the same local network as the victim,...

PT-2020-2501 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient access control in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via IIOP...

PT-2020-2210 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: The issue is related to the failure to protect the web page structure, allowing for cross-site...

PT-2020-2057 · Microsoft · Sharepoint Server +1

Name of the Vulnerable Software and Affected Versions: SharePoint Server affected versions not specified SharePoint Foundation affected versions not specified SharePoint Enterprise Server affected versions not specified Description: The issue is related to the failure to protect the web page...

PT-2020-2537

Name of the Vulnerable Software and Affected Versions Java SE versions 7u251, 8u241, 11.0.6, and 14 Java SE Embedded version 8u241 Description The issue is related to insufficient access control in the Libraries component of Java SE and Java SE Embedded, allowing an unauthenticated attacker with...

PT-2020-6008 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.6.3 Description: The issue is related to the function snd ctl elem add in the Linux kernel, specifically with the line count = info-owner, which can lead to errors when multiplying private size count. This coul...

PT-2020-2027

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions prior to the fixed version Description The issue is related to insufficient access control in the VMware Directory Service vmdir of VMware vCenter Server. This can allow a remote attacker to elevate their...

Unspecified Vulnerability in Samsung Mobile Devices (CNVD-2020-36249)

Android is a free and open source operating system from Google based on the Linux kernel without GNU components. An unspecified vulnerability exists in Samsung mobile devices, which can be exploited by an attacker to restrict a user's access to certain features, including making phone calls and...

PT-2020-19675 · Unknown · Eivindfjeldstad-Dot

Name of the Vulnerable Software and Affected Versions: eivindfjeldstad-dot versions prior to 1.0.3 Description: The issue concerns a Prototype Pollution problem. The set function can be tricked into adding or modifying properties of Object.prototype using a proto payload. This allows for potentia...

PT-2020-6522 · Sonatype · Sonatype Nexus Repository +1

Name of the Vulnerable Software and Affected Versions: Sonatype Nexus Repository versions prior to 3.21.2 Description: The issue is related to incorrect code generation management in the Sonatype Nexus Repository Manager, which can be exploited by a remote attacker to execute arbitrary code by...

PT-2020-2146 · Videolabs +1 · Libmicrodns +1

Name of the Vulnerable Software and Affected Versions: Videolabs libmicrodns version 0.1.0 Description: The issue is related to a denial-of-service vulnerability in the message-parsing functionality of libmicrodns. It occurs when parsing mDNS messages, as the implementation does not properly trac...

Information disclosure

In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other more complex ways...

PT-2020-10142 · Red Hat · Openshift/Mediawiki-Apb

Name of the Vulnerable Software and Affected Versions: openshift/mediawiki-apb versions prior to 4.3.0 Description: A vulnerability was found in the container openshift/mediawiki-apb, where an insecure modification vulnerability in the /etc/passwd file allows an attacker with access to the...

PT-2020-12267 · Denx +2 · Das U-Boot +2

Name of the Vulnerable Software and Affected Versions: Das U-Boot versions through 2020.01 Description: The issue allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration...

PT-2020-20583 · Aquaforest · Aquaforest Tiff Server

Name of the Vulnerable Software and Affected Versions: Aquaforest TIFF Server version 4.0 Description: The issue allows unauthenticated file and directory enumeration. This is achieved via the "tiffserver/tssp.aspx" endpoint. Recommendations: For Aquaforest TIFF Server version 4.0, consider...

PT-2020-6582

Name of the Vulnerable Software and Affected Versions Ansible Engine versions 2.7.x through 2.9.x Description A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and...