CVE-2020-26550: Use of Insufficiently Random Values

An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated systems is protected by a three-character key...

Authorization

IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The...

Denial Of Service (DoS)

linux kernel is vulnerable to denial of service. An out-of-bounds error in scalar32minmaxor in kernel/bpf/verifier.c during the use of 64-bit values allows an attacker to crash the kernel...

Exploit for Use of Insufficiently Random Values in Linux Linux_Kernel

CVE-2020-25705 PoC for CVE-2020-2...

Oracle Linux 7 : python3 (ELSA-2020-5010)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5010 advisory. - Avoid infinite loop when reading specially crafted TAR files CVE-2019-20907 Resolves: rhbz1856481 Tenable has extracted the preceding description blo...

Exploit for CVE-2020-1472

PoC exploit for CVE-2020-1472, a Windows Kerberos authentication...

IBM FileNet Content Manager CSV Injection Vulnerability

IBM FileNet Content Manager is a comprehensive enterprise content management ECM solution that uniquely combines content management with out-of-the-box workflow processes to help organizations manage complex documents and control, share and quickly access critical business information. A CSV...

CVE-2020-4759

IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 188736...

CVE-2020-27977

CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempts to edit registry values, allowing an attacker to escalate privileges...

PT-2020-16884

Name of the Vulnerable Software and Affected Versions CapaSystems CapaInstaller versions prior to 6.0.101 Description The issue allows an attacker to escalate privileges due to improper assignment, modification, or checking of privileges for an actor attempting to edit registry values...

CVE-2020-27977: Undefined Security Weakness

CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempts to edit registry values, allowing an attacker to escalate privileges...

CVE-2020-25398

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality...

Huawei EulerOS: Security Advisory for python-ipaddress (EulerOS-SA-2020-2472)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-22275

Easy Registration Forms ER Forms Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable...

UBUNTU-CVE-2020-22278

DISPUTED phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents."...

glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions

A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack corruption due to a stack-based overflow. The highest threat from this vulnerability is to system availability...

EulerOS 2.0 SP9 : python-ipaddress (EulerOS-SA-2020-2438)

According to the version of the python-ipaddress package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow...

CVE-2020-27358

An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature that allows users to export their conversation threads as CSV allows non-privileged users to export one another's conversation threads by changing the threadid parameter in the request to the endpoint...

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values aka CID-5b9fbeb75b6a.

...

Cross-site Scripting (XSS)

xxl-job-admin is vulnerable to cross-site scripting XSS. The vulnerability exists as the unsanitized values of xxlJobGroup, including AppName, Title, and AddressList could lead to an execution of javascript code when it is displayed in the list of job group...