CVE-2020-15710

Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/bluetooth/module-bluez5-device.c and src/modules/bluetooth/module-bluez5-device.c. Fixed in...

CVE-2020-6115: Use After Free

An exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. While searching for an object identifier in a malformed document that is missing from the cross-reference table, the application will save a reference to the...

ModSecurity 3.0.x Denial Of Service Vulnerability

ModSecurity version 3.0.x suffers from a denial of service vulnerability due to the handling of regular expression matching. ModSecurity version 3.0.x is affected by a denial of service vulnerability due to the global matching of regular expressions. The combination of a non-anchored regular...

CVE-2020-16855

An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory. An attacker who successfully exploited the vulnerability could view out of bound memory. Exploitation of the...

CVE-2020-16855

An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory. An attacker who successfully exploited the vulnerability could view out of bound memory. Exploitation of the...

CVE-2020-16855: Out-of-bounds Read

An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory. An attacker who successfully exploited the vulnerability could view out of bound memory. Exploitation of the...

PT-2020-22903

Уязвимость программного обеспечения для создания частной виртуальной сети astra-openvpn-server связана с некорректно заданными границами переменной. Эксплуатация уязвимости позволяет нарушителю, действующему удаленно, вызвать отказ в обслуживании...

GNU Bash Environment Variable Handling Code Injection (Shellshock)

The remote web server is affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via...

Microsoft SharePoint Server 2010 < 14.0.7255.5000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source...

Microsoft SharePoint Server 2019 < 16.0.10363.12107 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source...

PT-2020-4027 · Microsoft · Office For Mac +1

Name of the Vulnerable Software and Affected Versions: Microsoft Office for Mac affected versions not specified Microsoft Office affected versions not specified Description: The issue is related to an information disclosure problem caused by reading out of bound memory due to an uninitialized...

Command Injection in giting

All versions of gitting are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec call, which may allow attackers to execute arbitrary code in the system. The pull function is vulnerable through the branch variable. Recommendation No fix is current...

GHSA-7R9X-HR76-JR96 Command Injection in giting

All versions of gitting are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec call, which may allow attackers to execute arbitrary code in the system. The pull function is vulnerable through the branch variable. Recommendation No fix is current...

PT-2020-21082

Name of the Vulnerable Software and Affected Versions plotter versions all Description The issue concerns a command injection problem where the plotter package fails to properly sanitize plot titles. This could allow attackers to execute arbitrary code on the system if a user-supplied title value...

PT-2020-21132

Name of the Vulnerable Software and Affected Versions gitting versions affected versions not specified Description The issue concerns a Command Injection problem. The package fails to sanitize input, passing it directly to an exec call, which may allow attackers to execute arbitrary code in the...

Command Injection in node-wifi

Versions of node-wifi prior to 2.0.12 are vulnerable to Command Injection. The package fails to sanitize user input, allowing attackers to inject commands through the ssid variable and possibly achieving Remote Code Execution on the system. Recommendation No fix is currently available. Consider...

PT-2020-21231

Name of the Vulnerable Software and Affected Versions bootstrap-vue versions prior to 2.0.0-rc.12 Description The issue is related to insufficient input sanitization, making components vulnerable to Cross-Site Scripting through the options variable. This may lead to the execution of malicious...

bash: BASH_CMD is writable in restricted bash shells

rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASHCMDS, thus allowing the user to execute any command with the permissions of the shell...

PT-2020-18957

Name of the Vulnerable Software and Affected Versions OS4Ed openSIS version 7.4 Description A remote code execution issue exists in the install functionality. The password variable, set at line 122 in install/Step5.php, allows for injection of PHP code into the Data.php file. An attacker can send...

CVE-2020-15704 pppd arbitrary file read information disclosure vulnerability

The modprobe child process in the ./debian/patches/loadpppgenericifneeded patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBEOPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu1.4, 2.4.5-5.1ubuntu2.3+esm2,...