Archive
9 July 2020
Vulnerabilities first published on this day (UTC), newest first.
51 results · Feed
-
Low 3.1
IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cooki…
-
High 8.1
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to execute arbitrary code on the s…
-
High 8.6
Improper verification of signature threshold in tough
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures be…
-
High 7.2
Stored XSS in TimelineJS3
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheet…
-
Unscored —CVE-2020-15299 EPSS 47%
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remo…
-
Critical 9.4
Operation on a Resource after Expiration or Release in Jetty Server
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the Byte…
-
Unscored —
An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP applicati…
-
Unscored —
A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6. OpenPGP has three passwords: Admin …
-
Medium 4.3
An issue was discovered in Yubico libykpiv before 2.1.0. An attacker can trigger an incorrect free() in the ykpiv_util_…
-
Medium 4.3
An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-to…
-
Unscored —
Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the con…
-
Unscored —
Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted rep…
-
Unscored —
In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks c…
-
Unscored —
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw oc…
-
Unscored —
IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was be…
-
Unscored —
Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary …
-
Unscored —
An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the se…
-
Unscored —
During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which ent…
-
Unscored —
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak privat…
-
Unscored —
An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A blind time-based SQL injection issue allows remote u…
-
Unscored —
An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attac…
-
Unscored —
By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (wit…
-
Unscored —
When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path i…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corr…
-
Unscored —
When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This…
-
Unscored —
If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderb…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed ev…
-
Unscored —
When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially explo…
-
Unscored —
Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We…
-
Unscored —
For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridgin…
-
Unscored —
A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use…
-
Unscored —
In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, …
-
Unscored —
When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder i…
-
Unscored —
When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to m…
-
Unscored —
Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memor…
-
Unscored —
Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, lead…
-
Unscored —
When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were l…
-
Unscored —
When processing callbacks that occurred during window flushing in the parent process, the associated window may die; ca…
-
Unscored —
When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest t…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed e…