keycloak: Account REST API can update user metadata attributes

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...

Bitdefender Antivirus Plus 访问控制错误漏洞

Bitdefender Antivirus Plus is a suite of antivirus software from the Romanian company Bitdefender that provides mainly cyber threat detection and ransomware protection. An access control error vulnerability exists in versions prior to Bitdefender Antivirus Plus 25.0.7.29, which stems from a sourc...

GNOME Glib Input Validation Error Vulnerability

GNOME GLib is a multi-platform toolkit for creating graphical user interfaces, and is the underlying core library that underlies GTK+ and GNOME projects. An input validation error vulnerability exists in GNOME GLib versions prior to 2.65.3, which stems from an integer overflow, which could result...

CVE-2020-29654

Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account...

CVE-2020-29563

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device...

UBUNTU-CVE-2020-7788

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

ASUS RT-AC88U Injection Vulnerability

The ASUS RT-AC88U is a wireless router from the Chinese company ASUS. An injection vulnerability exists in ASUS RT-AC88U Download Master versions prior to 3.1.0.108, which originates from MainLogin.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp without filtering user input. An attacke...

UBUNTU-CVE-2020-26957

OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox...

DEBIAN-CVE-2020-27758

A flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned long long. This would most likely lead to an impact to application availability, but...

UBUNTU-CVE-2020-27750

A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char and math division by zero. This would...

UBUNTU-CVE-2020-27772

A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned int. This would most likely lead to an impact to application availability, but could...

ImageMagick Studio ImageMagick 输入验证错误漏洞

ImageMagick is a software for creating, editing, and composing images that can read, convert, and write images in many formats. An input validation error vulnerability exists in ImageMagick, where MagickCore/quantum.h in versions prior to ImageMagick 7.0.9-0 has a range of representable values...

McAfee Total Protection (MTP) 安全漏洞

McAfee Total Protection is a one-stop security suite. An elevation of privilege vulnerability exists in McAfee Total Protection versions prior to 16.0.29. An attacker can exploit the elevation of privilege vulnerability by creating a junction link to manipulate a folder...

CVE-2020-27659

Multiple cross-site scripting XSS vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web script or HTML via the 1 domain or 2 profile parameter...

CVE-2020-29371

An issue was discovered in romfsdevread in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd...

CVE-2020-7778

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

PT-2020-16754 · Teclib +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.3 Description: The issue is related to an Insecure Direct Object Reference IDOR vulnerability in the ajax/comments.php file. This vulnerability allows an attacker to read data from any database table, such as glpi...

JetBrains Toolbox Denial of Service Vulnerability

JetBrains Toolbox is a JetBrains product management application from the Czech company JetBrains. A denial-of-service vulnerability exists in JetBrains ToolBox versions prior to 1.18, which stems from susceptibility to denial-of-service attacks via the browser protocol handler. No detailed...

Intel Active Management Technology Access Control Error Vulnerability

Intel Active Management Technology AMT is a set of hardware-based computer remote active management technology software from Intel Intel. An Access Control Error vulnerability exists in Intel Active Management Technology versions prior to 1.3.3, which arises from a network system or product that...

Linux kernel 缓冲区错误漏洞

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A slab out-of-bounds read vulnerability exists in fbcon in Linux kernel versions prior to 5.9.7. The vulnerability...