Skip to content
OpenAdvisories

Archive

7 July 2020

Vulnerabilities first published on this day (UTC), newest first.

← June 2020 2020 / July /7 August 2020 →
  1. 171
  2. 254
  3. 311
  4. 41
  5. 513
  6. 628
  7. 770
  8. 818
  9. 951
  10. 1024
  11. 11 
  12. 12 
  13. 1320
  14. 14194
  15. 15278
  16. 1663
  17. 1773
  18. 18 
  19. 19 
  20. 2036
  21. 2118
  22. 2274
  23. 2341
  24. 2428
  25. 255
  26. 26 
  27. 2725
  28. 2886
  29. 2962
  30. 3051
  31. 3133
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.0
    CVE-2020-8916

    Memory leak in wpanctl can lead to DoS

    A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the servic…

    Google wpantund
  • Medium 5.3
    GHSA-jmqm-f2gx-4fjv

    Sensitive information exposure through logs in npm-registry-fetch

    Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is pri…

    npm-registry-fetch npm
  • Medium 4.4
    CVE-2020-15095

    Sensitive information exposure through logs in npm cli

    Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is print…

    npm cli npm npm Debian Ubuntu npm
  • Medium 5.9
    GHSA-wwgf-3xp7-cxj4

    Potentially sensitive data exposure in Symfony Web Socket Bundle

    ### Impact Inside `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()` does not succeed. Th…

    gos/web-socket-bundle Packagist
  • Medium 6.1
    CVE-2019-19935

    DOM-based cross-site scripting in Froala Editor

    Froala Editor before 3.2.3 allows XSS.

    froala-editor npm
  • Medium 5.3
    CVE-2020-15513

    Incorrect access control in typo3_forum

    The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.

    mittwald/typo3_forum Packagist
  • Medium 5.4
    CVE-2020-15514

    jh_captcha for Typo3 XSS Vulnerability

    The jh_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS.

    haffner/jh_captcha Packagist
  • Medium 5.4
    CVE-2020-15517

    ke_search for Typo3 XSS Vulnerability

    The ke_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS.

    tpwd/ke_search Packagist
  • Medium 6.8
    CVE-2020-15096

    Context isolation bypass via Promise in Electron

    In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using…

    electron electron electron npm
  • Medium 6.8
    CVE-2020-4075

    Arbitrary file read via window-open IPC in Electron

    In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window ev…

    electron electron electron npm