Archive
16 October 2020
Vulnerabilities first published on this day (UTC), newest first.
201 results · Feed
-
Medium 5.9
IBM Security Guardium Big Data Intelligence 1.0 (SonarG) uses weaker than expected cryptographic algorithms that could …
-
Unscored —
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, …
-
Unscored —
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, mac…
-
Unscored —
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, mac…
-
Unscored —
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13…
-
Unscored —
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, mac…
-
Unscored —
An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification. This issue …
-
Unscored —
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13…
-
Unscored —
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, m…
-
Unscored —
A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 1…
-
Unscored —
A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.…
-
Unscored —
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.6. An application m…
-
Unscored —
A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixe…
-
High 8.7CVE-2020-15255 Public exploit
CSV injection in Anuko Time Tracker
In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fix…
-
Unscored —
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.6. A mal…
-
High 7.5
Improper Authentication in Apereo CAS
Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.
-
Unscored —
Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user i…
-
Medium 6.1
Stored XSS in customer address upload feature
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS at…
-
Unscored —
In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow.
-
Unscored —
VMware Horizon Client for Windows (5.x before 5.5.0) contains a denial-of-service vulnerability due to a file system ac…
-
Unscored —
An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nam…
-
Unscored —
A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delega…
-
Unscored —
OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject ma…
-
Unscored —
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privil…
-
High 7.2
Arbitrary Code Execution in Gitea
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented imme…
-
Unscored —
In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge …
-
Unscored —
An issue was discovered in ClamXAV 3 before 3.1.1. A malicious actor could use a properly signed copy of ClamXAV 2 (run…
-
Unscored —
The BASSMIDI plugin 2.4.12.1 for Un4seen BASS Audio Library on Windows is prone to an out of bounds write vulnerability…
-
Unscored —
The BASS Audio Library 2.4.14 under Windows is prone to a BASS_StreamCreateFile Denial of Service vulnerability (infini…
-
Unscored —
The BASS Audio Library 2.4.14 under Windows is prone to a BASS_StreamCreateFile out of bounds read vulnerability via a …
-
Unscored —
The BASS Audio Library 2.4.14 under Windows is prone to a BASS_StreamCreateFile Use after Free vulnerability via a craf…
-
Critical 9.9
Arbitrary Code Execution in blazar-dashboard
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval f…
-
Unscored —
An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. The search field "Kurs suchen" on the page Kurskatalo…
-
Unscored —
An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. It allows unauthenticated users to upload JavaScript …
-
Unscored —
An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attack…
-
Unscored —
An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implement…
-
High 8.3
Mutation XSS exists in Mark Text through 0.16.2 that leads to Remote Code Execution. NOTE: this might be considered a d…
-
Unscored —
In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage …
-
Unscored —
In vm-superio before 0.1.1, the serial console FIFO can grow to unlimited memory usage when data is sent to the input s…
-
Unscored —
phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.