UBUNTU-CVE-2020-24379

WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection...

3a-server (>=0.7.41, <=0.9.10), 3a-server-mongo (>=0.1.0-beta.1, <=1.0.0-beta.1) +11 more potentially affected by unknown CVE via html-pdf-chrome (>=0.2.0, <=0.5.0)

html-pdf-chrome NPM version =0.2.0, =0.7.41, =0.1.0-beta.1, =0.1.3, =0.2.0, =1.0.0, =1.1.0, =1.0.0, =0.1.0, =1.0.3, =0.0.0, =0.5.12 Source cves: unknown CVE Source advisory: OSV:GHSA-5P98-WPC9-G498...

@draftbit/airtable-graphql (2.0.0), @draftbit/hapi-airtable-authentication-plugin (>=1.0.0, <=1.1.0) +34 more potentially affected by unknown CVE via airtable (>=0.4.5, <=0.6.0)

airtable NPM version =0.4.5, =1.0.0, =0.1.0, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =1.0.3, =0.0.1, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =1.0.9 and more Source cves: unknown CVE Source advisory: OSV:GHSA-JRJ9-5QP6-2V8Q...

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead default permissions are used.

...

CVE-2020-17496

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759...

Apache HTTP Server Environment Issues Vulnerabilities

Apache HTTP Server is the United States Apache Software Apache Software Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in Apache HTTP Server versions 2.4.20 through 2.4.43, which can be exploited by ...

PT-2020-14196 · Coreos +3 · Etcd +3

Name of the Vulnerable Software and Affected Versions: etcd versions 3.3.0 through 3.3.22 etcd versions 3.4.0 through 3.4.9 Description: The etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint...

CVE-2020-5617

Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unauthorized privileges and modify/obtain sensitive information or perform unintended operations via unspecified vectors...

CVE-2020-4644

IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

jackson-databind: Lacks certain xbean-reflect/JNDI blocking

A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availabili...

IBM QRadar SIEM Carbon Black Response Cross-Site Scripting Vulnerability

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, etc. Carbon Black Response i...

Unspecified Vulnerability in Sylabs Singularity (CNVD-2020-52438)

Singularity is a Linux-based container platform for running standalone applications. A security vulnerability exists in Sylabs Singularity versions 3.0 through 3.5. An attacker can exploit the vulnerability to bypass ECL protection...

CVE-2020-14563

Vulnerability in the Oracle Enterprise Communications Broker product of Oracle Communications Applications component: WebGUI. Supported versions that are affected are 3.0.0-3.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

Unspecified Vulnerability in Oracle Primavera Portfolio Management (CNVD-2020-52050)

Primavera Portfolio Management is a software solution for advising, planning, controlling and strategically analyzing your portfolio. A security vulnerability exists in the Web Server component in Primavera Portfolio Management 16.1.0.0-16.1.5.1, 18.0.0.0-18.0.2.0, 19.0.0.0. An attacker could...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2020-44273)

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, etc. Advanced Outbound Telephony is one of the tools used for outbound ca...

CVE-2020-7584

A vulnerability has been identified in SIMATIC S7-200 SMART CPU family All versions = V2.2 V2.5.1. Affected devices do not properly handle large numbers of new incomming connections and could crash under certain circumstances. An attacker may leverage this to cause a Denial-of-Service situation...

CVE-2020-14171

Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle MITM attack...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

rubygems: Escape sequence injection vulnerability in gem owner

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur...

PuTTY Information Disclosure Vulnerability

PuTTY is a suite of free Telnet, Rlogin and SSH client software from Simon Tatham Software Developers. The software is primarily used for remote administration of Linux systems. A security vulnerability exists in PuTTY versions 0.68 through 0.73. An attacker could exploit the vulnerability to...