5466 matches found
PT-2020-19786
Name of the Vulnerable Software and Affected Versions jsen versions all Description This issue affects the jsen package, allowing an attacker to run arbitrary JavaScript code on the victim machine if they can control the schema file. The required field of the schema is not properly sanitized, and...
Bugventure Jsen Security Breach
Bugventure Jsen is a Js package for verifying Json objects from the Bugventure personal developer. A security vulnerability exists in jsen that can be exploited by an attacker to take control of a schema file, which can then be used to run arbitrary JavaScript code on the victim machine...
A flaw was found in PostgreSQL versions before 13.1 before 12.5 before 11.10 before 10.15 before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
...
DEBIAN-CVE-2020-25695
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest...
UBUNTU-CVE-2020-25695
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest...
@medley/medley (>=0.11.0, <=0.12.1), @nova/azure-functions (>=0.3.0, <=0.3.3) +1 more potentially affected by CVE-2020-7764 via find-my-way (>=2.0.1, <=2.1.0)
find-my-way NPM version =2.0.1, =0.11.0, =0.3.0, =1.0.0, =1.1.0 Source cves: CVE-2020-7764 Source advisory: OSV:GHSA-JGRH-5M3H-9C5F...
wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl
A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This iss...
@medley/medley (>=0.11.0, <=0.12.1), @nova/azure-functions (>=0.3.0, <=0.3.3) +1 more potentially affected by CVE-2020-7764 via find-my-way (>=2.0.1, <=2.1.0)
find-my-way NPM version =2.0.1, =0.11.0, =0.3.0, =1.0.0, =1.1.0 Source cves: CVE-2020-7764 Source advisory: SNYK:JS-FINDMYWAY-1038269...
Amazon Linux AMI : mysql57 (ALAS-2020-1439)
The version of mysql57 installed on the remote host is prior to 5.7.31-1.16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1439 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are...
CVE-2020-15157: Insufficiently Protected Credentials
In containerd an industry-standard container runtime before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer otherwise known as a “foreign...
wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl
A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This iss...
wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl
A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This iss...
Prototype Pollution
simpl-schema is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
CVE-2020-7742
This affects the package simpl-schema before 1.10.2...
Code injection
This affects the package simpl-schema before 1.10.2...
CVE-2020-7742 Prototype Pollution
This affects the package simpl-schema before 1.10.2...
CVE-2020-7742
This affects the package simpl-schema before 1.10.2...
@demandcluster/api-plugin-files (>=1.0.0, <=1.0.4), @deskpro/apps-installer (>=0.3.1, <=0.4.5) +49 more potentially affected by CVE-2020-7742 via simpl-schema (>=0.0.1, <=1.8.1)
simpl-schema NPM version =0.0.1, =1.0.0, =0.3.1, =0.1.3, =0.0.3, =1.0.8, =0.0.9, =1.0.5, =1.2.3, =1.0.3, =0.0.1, =1.0.2, =1.0.5, =0.0.1, =0.0.1, =0.0.6 and more Source cves: CVE-2020-7742 Source advisory: MEND:CVE-2020-7742...
CVE-2020-7742
CVE-2020-7742 affects the JavaScript package simpl-schema up to version 1.10.1. The vulnerability is a prototype pollution flaw in the library's merge logic (used for merging inputs into schemas), allowing attacker-controlled input to mutate Object.prototype and potentially lead to remote code ex...
