CVE-2020-8539

Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker t...

Input validation

Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker t...

CVE-2020-8539

Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker t...

OPENSUSE-SU-2020:1966-1 Security update for moinmoin-wiki

This update for moinmoin-wiki fixes the following issues: - update to version 1.9.11: CVE-2020-25074 boo1178744: fix remote code execution via cache action CVE-2020-15275 boo1178745: fix malicious SVG attachment causing stored XSS vulnerability...

Puncsky Touchbase.ai Information Disclosure Vulnerability

Puncsky Touchbase.ai is a web platform for interpersonal relationships by Puncsky Individual Developers. A security vulnerability exists in versions prior to touchbase.ai 2.0, which stems from a failure to strip exif data from an image, thus leaking information. Anyone with access to an image...

Information disclosure

toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain its geolocation, device, and software version data etc if present. The issue is fixed in version 2.0...

CVE-2020-26220 Information exposure in touchbase.ai

toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain its geolocation, device, and software version data etc if present. The issue is fixed in version 2.0...

Foxit Studio Photo Remote Code Execution Vulnerability (CNVD-2020-59775)

Foxit Studio Photo is a set of image editing software from the Chinese company Foxit Foxit. A remote code execution vulnerability exists in the handling of CR2 files in Foxit Studio Photo 3.6.6.930 and earlier versions. The vulnerability stems from a lack of proper validation of user-supplied dat...

DEBIAN-CVE-2020-15271

In lookatme python/pypi package versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "fileloader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. ...

CVE-2020-7125

A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...

openMAINT 1.1-2.4.2 Arbitrary File Upload

Exploit Title: openMAINT 1.1-2.4.2 - Arbitrary File Upload Dork: N/A Date: 2020-08-19 Exploit Author: mrb3n Vendor Homepage: https://www.openmaint.org/en Software Link: https://sourceforge.net/projects/openmaint/files/1.1/openmaint-1.1-2.4.2.zip/download Version: 1.1-2.4.2 Category: Webapps Teste...

CVE-2020-26607

An issue was discovered in TimaService on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. PendingIntent with an empty intent is mishandled, allowing an attacker to perform a privileged action via a modified intent. The Samsung ID is SVE-2020-18418 October 2020...

Command injection

An issue was discovered on Samsung mobile devices with O8.x, P9.0, Q10.0, and R11.0 software. An attacker can access certain Secure Folder content via a debugging command. The Samsung ID is SVE-2020-18673 October 2020...

mariadb-connector-c: Improper validation of content in a OK packet received from server

libmariadb/mariadblib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadblib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle...

OPENSUSE-SU-2020:1578-1 Security update for brotli

This update for brotli fixes the following issues: brotli was updated to 1.0.9: CVE-2020-8927: Fix integer overflow when input chunk is longer than 2GiB boo1175825 brotli -v now reports raw / compressed size decoder: minor speed / memory usage improvements encoder: fix rare access to uninitialize...

OPENSUSE-SU-2020:1510-1 Security update for chromium

This update for chromium fixes the following issues: Chromium was updated to version 85.0.4183.102 bsc1176306 fixing: - CVE-2020-6573: Use after free in video. - CVE-2020-6574: Insufficient policy enforcement in installer. - CVE-2020-6575: Race in Mojo. - CVE-2020-6576: Use after free in offscree...

PT-2020-15890 · Genexis · Genexis Platinum 4410 V2

Name of the Vulnerable Software and Affected Versions: Genexis Platinum 4410 V2 version 2.1 software version P4410-V2-1.28 Description: The issue allows for changing the Wi-Fi password remotely due to Broken Access Control and CSRF. This could potentially be exploited to gain unauthorized access ...

vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50940)

vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the Smilie title of Smilies Manager...

SUSE-SU-2020:2443-1 Security update for squid

This update for squid fixes the following issues: squid was updated to version 4.13: - CVE-2020-24606: Fix livelocking in peerDigestHandleReply bsc1175671. - CVE-2020-15811: Improve Transfer-Encoding handling bsc1175665. - CVE-2020-15810: Enforce token characters for field-name bsc1175664...

CVE-2020-6781

Improper certificate validation for certain connections in the Bosch Smart Home System App for iOS prior to version 9.17.1 potentially allows to intercept video contents by performing a man-in-the-middle attack...