Skip to content
OpenAdvisories

Archive

6 October 2020

Vulnerabilities first published on this day (UTC), newest first.

← September 2020 2020 / October /6 November 2020 →
  1. 147
  2. 273
  3. 3 
  4. 41
  5. 523
  6. 672
  7. 728
  8. 855
  9. 941
  10. 106
  11. 11 
  12. 1260
  13. 1323
  14. 1452
  15. 1552
  16. 16201
  17. 171
  18. 181
  19. 1998
  20. 2049
  21. 21245
  22. 2299
  23. 2328
  24. 24 
  25. 251
  26. 2626
  27. 27173
  28. 2859
  29. 2954
  30. 3026
  31. 3114
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2020-13343

    An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Pr…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.5
    CVE-2020-15174

    Unpreventable top-level navigation in Electron

    In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation ac…

    electron electron electron npm
  • High 7.8
    CVE-2020-24807

    File restriction bypass in socket.io-file

    The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects…

    socket.io-file npm
  • High 8.2
    CVE-2020-7740 Public exploit

    Server-side Request Forgery (SSRF)

    This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an…

    node-pdf-generator npm
  • High 8.2
    CVE-2020-7739

    Server-side Request Forgery (SSRF)

    This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.

    phantomjs phantomjs-seo Ubuntu npm
  • High 7.5
    CVE-2020-8782

    ALEOS LAN-Side RPC Service Remote Code Execution

    Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.

  • High 7.5
    CVE-2020-25644

    Wildfly-OpenSSL memory leak flaw

    A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

    org.wildfly.openssl:wildfly-openssl-natives-parent Maven
  • High 7.5
    CVE-2020-25613 Public exploit

    WEBRick vulnerable to HTTP Request/Response Smuggling

    An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems