CVE-2020-7737 Prototype Pollution

All versions of package safetydance are vulnerable to Prototype Pollution via the set function...

CVE-2020-7737

All versions of package safetydance are vulnerable to Prototype Pollution via the set function...

CVE-2020-7736 Prototype Pollution

The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function...

CVE-2020-7736

The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function...

PT-2020-19753 · Bmoor · Bmoor

Name of the Vulnerable Software and Affected Versions: bmoor versions prior to 0.8.12 Description: The issue concerns Prototype Pollution via the set function. Recommendations: For versions prior to 0.8.12, update to version 0.8.12 or later to resolve the issue...

PT-2020-19754 · Unknown · Safetydance

Name of the Vulnerable Software and Affected Versions: safetydance versions all Description: The issue concerns Prototype Pollution via the set function. This affects all versions of the package, allowing for potential manipulation of object properties. Recommendations: For all versions, consider...

CVE-2020-15228

In the @actions/core npm module before version 1.2.6,addPath and exportVariable functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment...

Design/Logic Flaw

In the @actions/core npm module before version 1.2.6,addPath and exportVariable functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment...

@atlantis-lab/actl (>=0.4.0, <=0.4.37), @atlantis-lab/actl-check (>=0.1.0, <=0.4.18) +23 more potentially affected by CVE-2020-15228 via @actions/core (>=1.0.0, <=1.2.5)

@actions/core NPM version =1.0.0, =0.4.0, =0.1.0, =0.0.1, =0.1.0, =0.0.0-canary.6527017, =0.0.0-d99f4ac.0, =0.0.5, =3.5.2, =0.1.22, =0.1.1, =0.1.1, =0.1.1, =1.0.0, =1.4.3 - bugcatcher-github-action 0.1.0 and more Source cves: CVE-2020-15228 Source advisory: OSV:GHSA-MFWH-5M23-J46W...

kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field

A stack buffer overflow issue was found in the getrawsocket routine of the Host kernel accelerator for virtio net vhost-net driver. It could occur while doing an ictolVHOSTNETSETBACKEND call, and retrieving socket name in a kernel stack variable via getrawsocket. A user able to perform ioctl2 cal...

freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read

In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdpreadfontcapabilityset could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0...

[SECURITY] Fedora 33 Update: mysql-connector-java-8.0.21-1.fc33

MySQL Connector/J is a native Java driver that converts JDBC Java Database Connectivity calls into the network protocol used by the MySQL database. It lets developers working with the Java programming language easily build programs and applets that interact with MySQL and connect all corporate...

Privilege escalation in setuid mode via user namespaces in Bubblewrap

...

The vulnerability of the Resultant Set of Policy (RSoP) component in Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Resultant Set of Policy RSoP component in Windows operating systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

DEBIAN-CVE-2020-25559

gnuplot 5.5 is affected by double free when executing printsetoutput. This may result in context-dependent arbitrary code execution...

UBUNTU-CVE-2020-25559

gnuplot 5.5 is affected by double free when executing printsetoutput. This may result in context-dependent arbitrary code execution...

ModSecurity 3.0.x Denial Of Service Vulnerability

ModSecurity version 3.0.x suffers from a denial of service vulnerability due to the handling of regular expression matching. ModSecurity version 3.0.x is affected by a denial of service vulnerability due to the global matching of regular expressions. The combination of a non-anchored regular...

Prototype Pollution

keyd is vulnerable to prototype pollution. The vulnerability exists as it does not prevent the proto property to be set when the set function is called...

CVE-2020-0648

An elevation of privilege vulnerability exists when the Windows RSoP Service Application improperly handles memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges...

The vulnerability of the Cisco Jabber Client Framework for Windows software lies in its lack of measures to neutralize special elements used in the operating system’s command set. This allows a perpetrator to execute arbitrary code.

The vulnerability of the Cisco Jabber Client Framework for Windows software is related to the lack of measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...