Skip to content
OpenAdvisories

Archive

27 October 2020

Vulnerabilities first published on this day (UTC), newest first.

← September 2020 2020 / October /27 November 2020 →
  1. 147
  2. 273
  3. 3 
  4. 41
  5. 523
  6. 672
  7. 728
  8. 855
  9. 941
  10. 106
  11. 11 
  12. 1260
  13. 1323
  14. 1452
  15. 1552
  16. 16201
  17. 171
  18. 181
  19. 1998
  20. 2049
  21. 21245
  22. 2299
  23. 2328
  24. 24 
  25. 251
  26. 2626
  27. 27173
  28. 2859
  29. 2954
  30. 3026
  31. 3114
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High —
    GHSA-c27r-x354-4m68

    xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

    ### Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. ### Patches Version 2.0.0 has the fix. ### Workarounds The recommendation is to upgrade. In case tha…

    xml-crypto npm
  • High —
    GHSA-r82c-j4mq-5xfw

    Update bitlyshortener to >=0.5.0 to prevent generating some invalid short URLs

    ### Impact Due to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.5.0 can generate an invalid short URL when a vanity domain exists. ### Patches Upgrading `bitlyshortener` to 0.5.0 or newer will prevent the generation of any such i…

    bitlyshortener PyPI
  • High 7.1
    CVE-2020-15238 Public exploit

    Local privilege escalation Blueman

    Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polkit-1 is disabled and…

    blueman-project blueman blueman blueman Debian Ubuntu
  • High 7.5
    CVE-2020-7755

    Regular Expression Denial of Service (ReDoS)

    All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.

    dat.gui npm
  • High 7.8
    CVE-2020-11858 Public exploit

    Code execution with escalated privilegesn vlnerability in Operation bridge Manager and Operations Bridge (containerized) products.

    Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,…

    Micro Focus Operation Bridge Manager Operation Bridge (containerized)
  • High 7.5
    CVE-2020-7754

    Regular Expression Denial of Service (ReDoS)

    This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

    npm-user-validate npm
  • High 7.5
    CVE-2020-7753

    Regular Expression Denial of Service (ReDoS)

    All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

    trim npm