25 August 2020

53 results · Feed

• High 7.3
  CVE-2019-14904

  OS Command Injection and Improper Input Validation in ansible

  A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take ad…

  ansible ansible ansible ansible Debian Ubuntu Alpine PyPI
  Aug 25, 2020
• Unscored —
  CVE-2020-19005

  zrlog v2.1.0 has a vulnerability with the permission check. If admin account is logged in, other unauthorized users can…

  Aug 25, 2020
• High 7.8
  CVE-2020-15777

  Maven Extension plugin for Gradle Enterprise vulnerable to Deserialization of Untrusted Data

  An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execu…

  com.gradle:gradle-enterprise-maven-extension Maven
  Aug 25, 2020
• High 7.8
  CVE-2020-17404

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…

  Foxit Studio Photo
  Aug 25, 2020
• High 7.8
  CVE-2020-17403

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…

  Foxit Studio Photo
  Aug 25, 2020
• High 8.8
  CVE-2020-17389 EPSS 10%

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…

  Marvell QConvergeConsole
  Aug 25, 2020
• High 8.8
  CVE-2020-17387 EPSS 10%

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…

  Marvell QConvergeConsole
  Aug 25, 2020
• High 8.8
  CVE-2020-17388

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…

  Marvell QConvergeConsole
  Aug 25, 2020
• High 8.8
  CVE-2020-15645 EPSS 11%

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…

  Marvell QConvergeConsole
  Aug 25, 2020
• High 8.8
  CVE-2020-15644

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…

  Marvell QConvergeConsole
  Aug 25, 2020
• High 8.8
  CVE-2020-15643 EPSS 59%

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…

  Marvell QConvergeConsole
  Aug 25, 2020
• High 8.8
  CVE-2020-15642

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marv…

  Marvell QConvergeConsole
  Aug 25, 2020
• High 7.5
  CVE-2020-15641

  This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConv…

  Marvell QConvergeConsole
  Aug 25, 2020
• Critical 9.8
  CVE-2020-15639 EPSS 12%

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…

  Marvell QConvergeConsole
  Aug 25, 2020
• High 7.5
  CVE-2020-15640

  This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConv…

  Marvell QConvergeConsole
  Aug 25, 2020
• Medium 6.5
  CVE-2020-17402

  This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…

  Parallels Desktop
  Aug 25, 2020
• High 8.8
  CVE-2020-17399

  This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…

  Parallels Desktop
  Aug 25, 2020
• Medium 6.0
  CVE-2020-17401

  This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Des…

  Parallels Desktop
  Aug 25, 2020
• High 8.8
  CVE-2020-17400

  This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…

  Parallels Desktop
  Aug 25, 2020
• High 7.5
  CVE-2020-17397

  This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…

  Parallels Desktop
  Aug 25, 2020
• Medium 6.5
  CVE-2020-17398

  This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4…

  Parallels Desktop
  Aug 25, 2020
• High 8.8
  CVE-2020-17396

  This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…

  Parallels Desktop
  Aug 25, 2020
• High 7.5
  CVE-2020-17395

  This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…

  Parallels Desktop
  Aug 25, 2020
• Medium 6.5
  CVE-2020-17393

  This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3…

  Parallels Desktop
  Aug 25, 2020
• Medium 6.0
  CVE-2020-17394

  This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…

  Parallels Desktop
  Aug 25, 2020
• High 8.8
  CVE-2020-17392

  This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.3-…

  Parallels Desktop
  Aug 25, 2020
• Medium 6.5
  CVE-2020-17391

  This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3…

  Parallels Desktop
  Aug 25, 2020
• Low 3.8
  CVE-2020-17390

  This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-…

  Parallels Desktop
  Aug 25, 2020
• Unscored —
  CVE-2020-16197

  An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate tha…

  Aug 25, 2020
• Medium 6.5
  CVE-2020-7824

  Ericssonlg iPECS Privilege Escalation Vulnerability

  A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability is due to insecure permission when handling session cookies. An attacker could exploit this vulnera…

  Ericsson-LG iPCES UCM
  Aug 25, 2020
• Unscored —
  CVE-2020-24622

  In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.

  Aug 25, 2020
• Unscored —
  CVE-2020-16245

  Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that coul…

  Aug 25, 2020
• High 8.1
  CVE-2020-24616 Public exploit

  Code Injection in jackson-databind

  FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Aug 25, 2020
• Medium 6.1
  CVE-2020-14042

  Codiad Cross-site Scripting Vulnerability

  ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanage…

  codiad/codiad Packagist
  Aug 25, 2020
• Unscored —
  CVE-2020-24609 Public exploit

  TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the …

  Aug 25, 2020
• High 8.7
  GHSA-gr4j-r575-g665

  Cross-Site Scripting in highcharts

  Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they clic…

  highcharts npm
  Aug 25, 2020
• Unscored —
  CVE-2020-24242

  In Netwide Assembler (NASM) 2.15rc10, SEGV can be triggered in tok_text in asm/preproc.c by accessing READ memory.

  nasm nasm Debian Ubuntu
  Aug 25, 2020
• Unscored —
  CVE-2020-24241

  In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.

  nasm nasm Debian Ubuntu
  Aug 25, 2020
• Unscored —
  CVE-2020-24240

  GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte i…

  bison bison bison Debian Ubuntu Alpine
  Aug 25, 2020
• Unscored —
  CVE-2020-24614

  Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbit…

  fossil fossil Debian Ubuntu
  Aug 25, 2020