Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
Unscored —
u'Null pointer dereference in HP OfficeJet Pro 8210 jbig2 filter due to lack of check of PDF font array leads to denial…
-
Unscored —
u'XBL SEC clears only ZI region when loading Qualcomm-signed segments can lead to improper access issue' in Snapdragon …
-
Unscored —
u'Possible out of bound array write in rxdco cal utility due to lack of array bound check' in Snapdragon Compute, Snapd…
-
Unscored —
u'Possible out of bound access while copying the mask file content into the buffer without checking the buffer size' in…
-
Unscored —
u'Calling thread may free the data buffer pointer that was passed to the callback and later when event loop executes th…
-
Unscored —
u'Null Pointer exception while playing crafted mkv file as data stream get deleted on secondary invalid configuration' …
-
Unscored —CVE-2020-11117 EPSS 20%
u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with ar…
-
Unscored —
u'Information exposure issues while processing IE header due to improper check of beacon IE frame' in Snapdragon Auto, …
-
Unscored —
u'Possible out of bound write while processing association response received from host due to lack of check of IE lengt…
-
Unscored —
u'Buffer over read occurs while processing information element from beacon due to lack of check of data received from b…
-
Unscored —
u'While processing SMCInvoke asynchronous message header, message count is modified leading to a TOCTOU race condition …
-
Unscored —
u'Information disclosure issue occurs as in current logic as secure touch is released without clearing the display sess…
-
Unscored —
u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from …
-
Unscored —
u'Heap overflow in diag command handler due to lack of check of packet length received from user' in Snapdragon Auto, S…
-
Unscored —
u'Keymaster attestation key and device IDs provisioning which is a one time process is incorrectly allowed to be re-pro…
-
Unscored —
u'Possible integer overflow in API due to lack of check on large oid range count in cert extension field' in Snapdragon…
-
Unscored —
u'Pointer double free in HavenSvc due to not setting the pointer to NULL after freeing it' in Snapdragon Auto, Snapdrag…
-
Unscored —
u'When a new session is created, Object is returned that contains TZ addresses and it get passed to HLOS as an handle t…
-
Unscored —
u'Accessing an uninitialized data structure could result in partially copying of contents and thus incorrect processing…
-
Unscored —
u'Lack of check that the TX FIFO write and read indices that are read from shared RAM are less than the FIFO size resul…
-
Unscored —
u'Lack of check for integer overflow for round up and addition operations result into memory corruption and potential i…
-
Unscored —
u'Lack of check that the current received data fragment size of a particular packet that are read from shared memory ar…
-
Unscored —
u'Out of bound memory access if stack push and pop operation are performed without doing a bound check on stack top' in…
-
Unscored —
u'Lack of integer overflow check for addition of fragment size and remaining size that are read from shared memory can …
-
Unscored —
u'Memory can be potentially corrupted if random index is allowed to manipulate TLB entries in Kernel from user library'…
-
Unscored —
u'User Process can potentially corrupt kernel virtual page by passing a crafted page in API' in Snapdragon Auto, Snapdr…
-
Unscored —
u'Improper access control can lead signed process to guess pid of other processes and access their address space' in Sn…
-
Unscored —
u'Possibility of integer overflow in keymaster 4 while allocating memory due to multiplication of large numcerts value …
-
Unscored —
u'SMEM partition can be manipulated in case of any compromise on HLOS, thus resulting in access to memory outside of SM…
-
Unscored —
u'Improper authentication and signature verification of debug polices in secure boot loader will allow unverified debug…
-
Unscored —
u'Error in UE due to race condition in EPCO handling' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, …
-
Unscored —
add-apt-repository print ASNI terminal codes
Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal co…
-
Unscored —
An Incorrect Access Control vulnerability exists in /ucms/chk.php in UCMS 1.4.8. This results in information leak via a…
-
Unscored —
Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File…
-
Unscored —
Tenda AC18 Router through V15.03.05.05_EN and through V15.03.05.19(6318) CN devices could cause a remote code execution…
-
High 7.5
Path Traversal in pip
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _d…
-
Low —
personnummer/js vulnerable to Improper Input Validation
This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severi…
-
High —
Remote Code Execution in next
Versions of `next` prior to 5.1.0 are vulnerable to Remote Code Execution. The `/path:` route fails to properly sanitize input and passes it to a `require()` call. This allows attackers to execute JavaScript code on the server. Note that prior version 0.9.9 p…
-
High 7.5
Denial of Service in http-proxy
Versions of `http-proxy` prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an `ERR_HTTP_HEADERS_SENT` unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in t…
-
High —
Denial of Service in @commercial/ammo
Versions of `@commercial/ammo` prior to 2.1.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting t…