CVE-2020-3812

Removed by vendor...

CVE-2020-3812: Improper Privilege Management

qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's home directory, witho...

CVE-2020-3811: Improper Initialization

qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability...

PT-2020-3627

Name of the Vulnerable Software and Affected Versions netqmail version 1.06 Description The issue is related to the qmail-verify module in the netqmail email client, which lacks protection for service data. This can allow an attacker to gain access to confidential data. A local attacker can test...

PT-2020-3626

Name of the Vulnerable Software and Affected Versions netqmail version 1.06 Description The issue is related to a lack of input validation in the qmail-verify module of the netqmail email client. This can be exploited by a remote attacker to compromise data integrity. The vulnerability allows for...

ParamKit - A Small Library Helping To Parse Commandline Parameters

A small library helping to parse commandline parameters for Windows. Objectives "like Python's argparse but for C/C++" compact and minimalistic easy to use extendable Demo Print help for each parameter: Easily store values of popular types, and verify if all required parameters are filled: Verify...

Linux kernel resource management error vulnerability (CNVD-2020-41818)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the xfsagfverify file in fs/xfs/libxfs/xfsalloc.c in Linux kernel 5.6.10 and earlier. An attacker can exploit this vulnerability to...

strongSwan gmp IPSEC Plugin Disclosure

The vulnerability of the verifyemsapkcs1ignature function gmprsapublickey.c in the gmp IPSEC plugin for the strongSwan daemon allows for the exploitation of the cryptographic signature verification process. Exploiting this vulnerability could enable a malicious actor, operating remotely, to...

wawpack: Out-of-bounds read in WavpackVerifySingleBlock function leads to DoS

The function WavpackVerifySingleBlock in openutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service out-of-bounds read and application crash via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack...

OpenSSL: EDIPARTYNAME NULL Pointer De-reference Vulnerability (CVE-2020-1971) - Linux

OpenSSL is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl";...

wbexhibit.otis.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1144189 Security Researcher g0bl1nsec Helped patch 3754 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting wbexhibit.otis.edu websit...

CVE-2020-5290

In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the token=$ssid hash when making a request to the /verify endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that victim...

CVE-2020-5290

In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the token=$ssid hash when making a request to the /verify endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that victim...

Session fixation

In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the token=$ssid hash when making a request to the /verify endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that victim...

CVE-2020-5290

In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the token=$ssid hash when making a request to the /verify endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that victim...

CVE-2020-5290

In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the "token=$ssid" hash when making a request to the "/verify" endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that vict...

CVE-2020-5290 session fixation in rCTF

In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the token=$ssid hash when making a request to the /verify endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that victim...

CVE-2020-5290: Session Fixation

In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the token=$ssid hash when making a request to the /verify endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that victim...

PT-2020-18380

Name of the Vulnerable Software and Affected Versions RedpwnCTF versions prior to 2.3 Description The issue is related to a session fixation vulnerability that can be exploited through the token=$ssid hash when making a request to the "/verify" endpoint. An attacker could potentially steal flags ...

CVE-2020-10184

The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service...