Archive
July 2020
Vulnerabilities first published in this month (UTC), newest first.
1,428 results · Feed
-
Medium 4.3
An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-to…
-
Unscored —
Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the con…
-
Unscored —
Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted rep…
-
Unscored —
In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks c…
-
Unscored —
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw oc…
-
Unscored —
IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was be…
-
Unscored —
Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary …
-
Unscored —
An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the se…
-
Unscored —
During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which ent…
-
Unscored —
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak privat…
-
Unscored —
An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A blind time-based SQL injection issue allows remote u…
-
Unscored —
An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attac…
-
Unscored —
By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (wit…
-
Unscored —
When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path i…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corr…
-
Unscored —
When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This…
-
Unscored —
If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderb…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed ev…
-
Unscored —
When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially explo…
-
Unscored —
Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We…
-
Unscored —
For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridgin…
-
Unscored —
A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use…
-
Unscored —
In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, …
-
Unscored —
When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder i…
-
Unscored —
When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to m…
-
Unscored —
Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memor…
-
Unscored —
Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, lead…
-
Unscored —
When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were l…
-
Unscored —
When processing callbacks that occurred during window flushing in the parent process, the associated window may die; ca…
-
Unscored —
When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest t…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed e…
-
Unscored —
Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malici…
-
Unscored —
When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, …
-
Unscored —
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at …
-
Unscored —
In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-…
-
Unscored —
In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and …
-
High 7.1
Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious u…
-
Medium 5.3CVE-2020-7693 Public exploit
Denial of Service (DoS)
Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
-
High 7.4
Improper Authorization
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization requ…
-
Unscored —
D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOT…