Skip to content
OpenAdvisories

Archive

5 June 2020

Vulnerabilities first published on this day (UTC), newest first.

← May 2020 2020 / June /5 July 2020 →
  1. 138
  2. 256
  3. 3127
  4. 4100
  5. 533
  6. 65
  7. 78
  8. 834
  9. 9222
  10. 1074
  11. 11123
  12. 1228
  13. 13 
  14. 143
  15. 1590
  16. 1653
  17. 1752
  18. 1884
  19. 19193
  20. 202
  21. 218
  22. 2280
  23. 2327
  24. 2466
  25. 2574
  26. 26104
  27. 272
  28. 283
  29. 2972
  30. 3052
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium —
    GHSA-w42g-7vfc-xf37

    Introspection in schema validation in Apollo Server

    We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The _Resolution_ section contains details on patched versions. ### Impact If `subscriptions: false` is passed to the `ApolloServer` constructor options, th…

    apollo-server-core apollo-server apollo-server-lambda apollo-server-cache-memcached npm
  • Medium —
    GHSA-v73w-r9xg-7cr9

    Use of insecure jQuery version in OctoberCMS

    ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. ### Patches Issue has been patched in Build 466 (v1.0.466) by applying th…

    october/system october/october Packagist
  • Medium 6.5
    CVE-2020-13868

    Comments plugin Cross-Site Request Forgery (CSRF)

    An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.

    verbb/comments Packagist
  • Medium 5.4
    CVE-2020-13869

    Comments plugin stored Cross-site Scripting via a guest name

    An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.

    verbb/comments Packagist
  • Medium 5.4
    CVE-2020-13870

    Comments plugin stored Cross-site Scripting (XSS) via an asset volume name

    An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.

    verbb/comments Packagist
  • Medium 6.8
    CVE-2020-10063

    Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow

    A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

    zephyrproject-rtos Zephyr
  • Medium 5.1
    CVE-2020-10068

    Zephyr Bluetooth DLE duplicate requests vulnerability

    In the Zephyr project Bluetooth subsystem, certain duplicate and back-to-back packets can cause incorrect behavior, resulting in a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later …

    zephyrproject-rtos Zephyr
  • Medium 5.6
    CVE-2020-4229

    IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, …

    IBM MobileFirst Platform Foundation