EulerOS 2.0 SP9 : python-ipaddress (EulerOS-SA-2020-2438)

According to the version of the python-ipaddress package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow...

CVE-2020-27358

An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature that allows users to export their conversation threads as CSV allows non-privileged users to export one another's conversation threads by changing the threadid parameter in the request to the endpoint...

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values aka CID-5b9fbeb75b6a.

...

Cross-site Scripting (XSS)

xxl-job-admin is vulnerable to cross-site scripting XSS. The vulnerability exists as the unsanitized values of xxlJobGroup, including AppName, Title, and AddressList could lead to an execution of javascript code when it is displayed in the list of job group...

Cisco Firepower Management Center DoS (cisco-sa-ftdfmc-dos-NjYvDcLA)

According to its self-reported version, Cisco Firepower Management Center is affected by a denial of service DoS vulnerability in its licensing service component due to improper handling of system resource values. An unauthenticated, remote attacker can exploit this issue, by sending specially...

EulerOS 2.0 SP5 : python-ipaddress (EulerOS-SA-2020-2265)

According to the version of the python-ipaddress package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow...

CVE-2020-27986

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it...

PT-2020-16890 · Sonarsource · Sonarqube

Name of the Vulnerable Software and Affected Versions: SonarQube version 8.4.2.36762 Description: The issue allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the "api/settings/values" URI. The vendor's position is that it is the administrator's responsibility to...

CVE-2020-27986: Missing Authentication for Critical Function

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it...

CVE-2020-7755

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service ReDoS via specifically crafted rgb and rgba values...

CVE-2020-7755 Regular Expression Denial of Service (ReDoS)

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service ReDoS via specifically crafted rgb and rgba values...

CVE-2020-7755

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service ReDoS via specifically crafted rgb and rgba values...

PT-2020-19769 · Dat · Dat.Gui

Name of the Vulnerable Software and Affected Versions: dat.gui versions prior to a fixed version Description: The issue is related to Regular Expression Denial of Service ReDoS via specifically crafted rgb and rgba values. This can be exploited in all versions of the package dat.gui...

CVE-2020-27180: Use of Insufficiently Random Values

konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter...

CVE-2020-27743: Use of Insufficiently Random Values

libtac in pamtacplus through 1.5.1 lacks a check for a failure of RANDbytes/RANDpseudobytes. This could lead to use of a non-random/predictable sessionid...

Authorization Bypass

postgresql is vulnerable to authroization bypass. The selectivity estimators allows an attacker to bypass row security policies and view common values of certain columns...

jenkins: user-specified tooltip values leads to stored cross-site scripting

A flaw was found in Jenkins in versions prior to 2.251 and LTS 2.235.3. Tooltip values, which are not properly escaped, can be contributed by plugins and use user-specified values. This results in a potential stored cross-site scripting XSS vulnerability. This highest threat from this vulnerabili...

CVE-2020-3499 Cisco Firepower Management Center Software Denial of Service Vulnerability

A vulnerability in the licensing service of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition.The vulnerability is due to improper handling of system resource values by the affected system. An attacker could...

postgresql: Selectivity estimators bypass row security policies

PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit thi...

Anuko Time Tracker Injection Vulnerability

Anuko Time Tracker is an open source time counting system for individual developers. A platform for counting the time spent by employees on various tasks. A security vulnerability exists in versions prior to Anuko Time Tracker 1.19.23.5325, which stems from a failure to properly filter user input...