October CMS Information Disclosure Vulnerability

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. An information disclosure vulnerability exists in versions of October CMS prior to 1.0.468 that stems from the program not binding an encrypted cookie value to the cookie name of that...

jackson-databind: Serialization gadgets in javax.swing.JEditorPane

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality...

slpjs Input Validation Error Vulnerability

slpjs is a JavaScript library for validating and building the Simple Ledger Protocol SLP. An input validation error vulnerability exists in versions of slpjs prior to 0.21.4. The vulnerability stems from a network system or product that does not properly validate input data...

Google Chrome Code Execution Vulnerability (CNVD-2020-49886)

Google Chrome is a web browser from Google, Inc.SCTP is one of the Stream Control Transmission Protocols SCTP. A security vulnerability exists in SCTP in versions prior to Google Chrome 84.0.4147.105. An attacker can exploit the vulnerability to execute arbitrary code with the help of specially...

DEBIAN-CVE-2020-6511

Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2020-14618

Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Mobile App. The supported version that is affected is Prior to 20.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Primavera Unifier...

CVE-2020-13923

IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04...

Google Chrome CSP Policy Bypass Vulnerability

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A CSP policy bypass vulnerability exists in versions prior to Google Chrome 84.0.4147.89, no detailed vulnerability details are available at this time...

Bitcoin wxBitcoin/bitcoind Denial of Service Vulnerability

A vulnerability exists in Bitcoin wxBitcoin and bitcoind versions prior to 0.3.5. A remote attacker could use this vulnerability to cause a denial of service daemon crash via a Bitcoin transaction containing the OPLSHIFT script opcode...

sane-backends: Heap buffer overflow in esci2_img

A flaw was found in sane-backends in versions prior to 1.0.30. A heap buffer overflow in the esci2img function could lead to a remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2020-12426

Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 78...

CVE-2020-12404

For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS 26...

CMSUno Cross-Site Request Forgery Vulnerability

CMSUno is a tool for creating single-page responsive websites by French software developer Jacques Malgrange. A cross-site request forgery vulnerability exists in versions of CMSUno prior to 1.6.1. The vulnerability stems from a WEB application that does not adequately validate that a request is...

CVE-2020-15573

SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421...

McAfee Total Protection Elevation of Privilege Vulnerability (CNVD-2020-53310)

McAfee Total Protection MTP is a suite of antivirus software from the American company McAfee. An elevation of privilege vulnerability exists in versions prior to McAfee MTP 16.0.R26, which can be exploited by a local attacker to unauthoritatively delete files via a malicious script or program...

Cisco Digital Network Architecture Center Information Disclosure Vulnerability (CNVD-2020-45582)

Cisco Digital Network Architecture Center DNA Center is a set of digital network architecture solutions from the U.S. company Cisco Cisco. The program can extend and protect devices, applications, etc. within the network. An information disclosure vulnerability exists in Cisco DNA Center versions...

SQLite Buffer Overflow Vulnerability (CNVD-2020-52847)

SQLite is the United States D. Richard Hipp software developers of a set of C-based open source embedded relational database management system. The system is characterized by independence, isolation, cross-platform and so on. A buffer overflow vulnerability exists in multiSelectOrderBy in version...

CVE-2020-4028

Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability...

CVE-2019-20409

The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability...

FreeRDP Buffer Overflow Vulnerability (CNVD-2020-35694)

FreeRDP is an open source implementation of the Remote Desktop Protocol RDP from the FreeRDP team. A buffer overflow vulnerability exists in versions prior to FreeRDP 2.1.2. The vulnerability stems from a networked system or product performing operations in memory without properly validating data...