arekit (>=0.21.0 <=0.22.1), arenets (>=0.23.0 <=0.23.1) +49 more potentially affected by CVE-2020-26266 via tensorflow-gpu (>=1.10.1 <=1.15.4)

tensorflow-gpu PYPI version =1.10.1, =0.21.0, =0.23.0, =0.1.0, =0.1.0, =1.0.0, =0.2.3, =0.0.1, =0.0.7, =0.2.0 - keras-textclassification =0.1.6 and more Source cves: CVE-2020-26266 Source advisory: OSV:GHSA-QHXX-J73R-QPM2...

CVE-2020-8286

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response...

HashiCorp Consul Docker images security vulnerability

Hashicorp HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp Hashicorp USA. The product is used to connect and provision applications across dynamically distributed infrastructures. A security vulnerability exists in HashiCorp official Consul...

adi (>=0.4.0 <=0.6.0), adi_screen (>=0.3.0 <=0.7.0) +167 more potentially affected by CVE-2020-35923 via ordered-float (>=0.2.3 <=1.0.2)

ordered-float CARGO version =0.2.3, =0.4.0, =0.3.0, =0.7.5, =0.6.0, =0.1.0, =0.1.0, =0.1.1, =0.2.0, =3.1.3, =0.1.1, =0.9.0, =0.23.0 and more Source cves: CVE-2020-35923 Source advisory: OSV:RUSTSEC-2020-0082...

PT-2020-17157 · Genivia · Dlt-Daemon

Name of the Vulnerable Software and Affected Versions: dlt-daemon versions 2.8.5 through 2.18.5 Description: A buffer overflow in the dlt filter load function in dlt common.c allows arbitrary code execution because fscanf is misused, with no limit on the number of characters to be read in the...

WESEEK GROWI Cross-Site Scripting Vulnerability

Weseek WESEEK GROWI is a suite of team collaboration software from the Japanese company WESEEK Weseek. A cross-site scripting vulnerability exists in GROWI versions 3.0.2 through 3.8.1. The vulnerability stems from a failure to adequately validate user-supplied data during the processing of a POS...

tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become...

Hashicorp HashiCorp Consul Security Breach

Hashicorp HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp Hashicorp USA. The product is used to connect and provision applications across a dynamically distributed infrastructure. A security vulnerability exists in HashiCorp Consul and Consu...

PT-2020-13496 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.14 through 13.3.8 GitLab CE/EE versions 13.4 through 13.4.4 GitLab CE/EE versions 13.5 through 13.5.1 Description: An issue has been discovered in GitLab CE/EE that affects all versions starting from 8.14. A path...

CVE-2020-13351

Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...

@across-ui/example (>=0.0.1-alpha.4 <=0.0.4-alpha.5), @agreejs/api (>=0.0.1 <=3.2.14) +752 more potentially affected by CVE-2021-23337 via lodash-es (>=4.0.0 <=4.17.20)

lodash-es NPM version =4.0.0, =0.0.1-alpha.4, =0.0.1, =0.0.2, =3.2.1, =3.2.1, =3.2.1, =0.0.1, =3.2.1, =3.2.1, =0.1.0, =0.3.14, =0.4.63, =0.4.64 and more Source cves: CVE-2021-23337 Source advisory: SNYK:JS-LODASHES-2434284...

HiddenBytes (=0.1.0), Rust-wasm (=0.1.0) +726 more potentially affected by CVE-2020-35916 via image (>=0.10.4 <=0.23.10)

image CARGO version =0.10.4, =0.1.0, =0.1.0, =0.0.3, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =0.1.0, =0.3.0 and more Source cves: CVE-2020-35916 Source advisory: OSV:RUSTSEC-2020-0073...

PT-2020-16961 · Deephas · Deephas

Name of the Vulnerable Software and Affected Versions: deephas versions 1.0.0 through 1.0.5 Description: The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability. Recommendations: For deephas versions 1.0.0 through...

PYSEC-2020-26

Synopsys hub-rest-api-python aka blackduck on PyPI version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases...

Micro Focus Self Service Password Reset Information Disclosure Vulnerability

Micro Focus Self Service Password Reset SSPR is a simple, secure, and easy-to-deploy self-service password management tool that helps users reset or re-enable their own network passwords without having to call the help desk. An information disclosure vulnerability exists in Micro Focus Self Servi...

freerdp: out-of-bounds read in bitmap.c

libfreerdp/cache/bitmap.c in FreeRDP versions 1.0 through 2.0.0-rc4 has an Out of bounds read...

httpd: mod_proxy_uwsgi buffer overflow

A flaw was found in Apache httpd in versions 2.4.32 to 2.4.46. The uwsgi protocol does not serialize more than 16K of HTTP header leading to resource exhaustion and denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availabilit...

IBM Spectrum Scale Cross-Site Scripting Vulnerability (CNVD-2020-59701)

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

Unspecified Vulnerability in Oracle Communications Diameter Signaling Router

Oracle Communications Diameter Signaling Router DSR is a signaling router for communications applications from Oracle Corporation. A security vulnerability exists in Oracle Communications Diameter Signaling Router versions 8.0.0.0 through 8.4.0.5, which can be exploited by an attacker to gain...

jackson-databind: Lacks certain xbean-reflect/JNDI blocking

A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availabili...