Archive
22 October 2020
Vulnerabilities first published on this day (UTC), newest first.
99 results · Feed
-
Medium 4.3
Improper session expiration in Parse Server
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with in…
-
High 8.8
Arbitrary code execution vulnerability on multiple Micro Focus products
Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management af…
-
Unscored —
An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption…
-
Unscored —
An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (dat…
-
Unscored —
An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve…
-
Unscored —
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a …
-
Unscored —
An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying k…
-
Unscored —
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_b…
-
Unscored —
If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distingui…
-
Unscored —
When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could h…
-
Unscored —
When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what applicatio…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some o…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corr…
-
Unscored —
In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting i…
-
Unscored —
A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.
-
Unscored —
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases wh…
-
Unscored —
Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in info…
-
Unscored —
In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a nu…
-
Unscored —
An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, w…
-
Medium 6.0
An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions s…
-
High 7.8
fabric8-maven-plugin: insecure way to construct Yaml Object leading to remote code execution
A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data …
-
Unscored —
Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 1 of 2).
-
Unscored —
Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 2 of 2).
-
Critical 9.8
Authorization bypass in Strapi
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.
-
High 7.5
Improper Authorization in Strapi
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.
-
Medium 5.4
Cross-site Scripting in Strapi
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.
-
Unscored —
Atmel Advanced Software Framework (ASF) 4 has an Integer Overflow.
-
Unscored —
A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Ca…
-
Unscored —
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.…
-
Unscored —
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, m…
-
Unscored —
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, ma…
-
Unscored —
A race condition was addressed with additional validation. This issue is fixed in macOS Catalina 10.15.6. A malicious a…
-
Unscored —
A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This …
-
Unscored —
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13…
-
Unscored —
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, m…
-
Unscored —
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6. …
-
Unscored —
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.6. A local user may be able …
-
Unscored —
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, ma…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6. A user may b…