CVE-2020-17495

CVE-2020-17495 affects django-celery-results up to version 1.2.1: task results are stored in the database and may include the original task variables, which can contain sensitive cleartext data. The Red Hat entry reiterates that this data is stored unencrypted in the database, implying potential ...

CVE-2020-6543

Use after free in task scheduling in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2020-17495: Cleartext Storage of Sensitive Information

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database...

Google Chrome Code Execution Vulnerability (CNVD-2020-49881)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Task Arrangement in versions prior to Google Chrome 84.0.4147.125. An attacker could exploit the vulnerability to execute arbitrary code or cause a denial of service...

PT-2020-5690

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 84.0.4147.125 Description The issue is related to a use after free in task scheduling, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This may enable the attacker to acce...

Google Chrome Task Scheduler Confidential Data Access DoS

The vulnerability of Google Chrome’s task scheduler relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service failures through a specially created HTML page...

CVE-2020-4534

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute...

CVE-2020-4534: Undefined Security Weakness

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute...

PT-2020-18118

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue is caused by improper handling of UNC paths, allowing a local authenticated attacker to gain elevated privileges on the system. An attacker could exploit this by...

CVE-2020-4534

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute...

kernel: Rogue cross-process SSBD shutdown. Linux scheduler logical bug allows an attacker to turn off the SSBD protection.

A logic bug flaw was found in the Linux kernel’s implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per...

Microsoft Edge (Chromium) < 81.0.416.68 Multiple Vulnerabilities

The version of Microsoft Edge Chromium installed on the remote Windows host is prior to 81.0.416.68. It is, therefore, affected by multiple vulnerabilities: - A use after free in storage in Microsoft Edge Chromium allowed a remote attacker who had compromised the renderer process to potentially...

Mail.ru: Un Authencitated Quartz Pannel with Scheduling tasks

Access to staging testing host task control panel was not restricted and allowed to stop or start scheduled task...

PT-2020-21720

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the following functions: apply sao internal, apply sao, and thread task sao::work...

PT-2020-21788

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow read error. Technical details about the crash include the involvement of specific functions such as apply s...

kernel: Rogue cross-process SSBD shutdown. Linux scheduler logical bug allows an attacker to turn off the SSBD protection.

A logic bug flaw was found in the Linux kernel’s implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per...

kernel: Rogue cross-process SSBD shutdown. Linux scheduler logical bug allows an attacker to turn off the SSBD protection.

A logic bug flaw was found in the Linux kernel’s implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per...

UBUNTU-CVE-2020-15852

An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tssinvalidateiobitmap mishandling causes a loss of synchronization between the I/O bitmaps ...

CVE-2020-15051

An issue was discovered in Artica Proxy before 4.30.000000. Stored XSS exists via the Server Domain Name, Your Email Address, Group Name, MYSQL Server, Database, MYSQL Username, Group Name, and Task Description fields...

CVE-2020-15051

An issue was discovered in Artica Proxy before 4.30.000000. Stored XSS exists via the Server Domain Name, Your Email Address, Group Name, MYSQL Server, Database, MYSQL Username, Group Name, and Task Description fields...