Archive
October 2020
Vulnerabilities first published in this month (UTC), newest first.
39 results · Clear filters · Feed
-
Low 3.3
IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error messa…
-
Low 3.7
IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attac…
-
Low —
CLI does not correctly implement strict mode
In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a…
-
Low 3.8
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Setti…
-
Low 3.1
Privilege Context Switching Error in Elasticsearch
Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the sear…
-
Low 3.7
Undefined behavior in Tensorflow
In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attempting to operate on this is undefined behavior which later …
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that…
-
Low 2.7
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versi…
-
Low 3.0
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affec…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions tha…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions tha…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Low 3.1
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions tha…
-
Low 3.1
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions tha…
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are…
-
Low 2.2
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions …
-
Low 3.7
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions…
-
Low 2.0
Vulnerability in the Hyperion BI+ product of Oracle Hyperion (component: IQR-Foundation service). The supported version…
-
Low 2.7
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4,…
-
Low 3.1
Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Application…
-
Low 3.1
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12…
-
Low 2.5
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affect…
-
Low 2.8
Vulnerability in the SQL Developer Install component of Oracle Database Server. Supported versions that are affected ar…
-
Low 3.1
Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Application…
-
Low 3.8
Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 11.2.…
-
Low —
Denial of Service via Cache Flooding
### Impact Denial of Service via Cache Flooding ### Patches We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#sh…
-
Low 3.7
Invalid integrity hashes in webpack-subresource-integrity
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection o…
-
Low —
Memory exhaustion in http4s-async-http-client with large or malicious compressed responses
### Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only …
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low 3.1
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WAC720 before 3.9.1.13 and WA…
-
Low 3.2
NETGEAR GS808E devices before 1.7.1.0 are affected by denial of service.
-
Low 3.3
NETGEAR EX7700 devices before 1.0.0.210 are affected by incorrect configuration of security settings.
-
Low 3.3
Access token stored in plain text by Jenkins SMS Notification Plugin
Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 3.3
Password stored in plain text by Jenkins couchdb-statistics Plugin
Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 2.7
An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at…
-
Low 3.5
Directory Traversal in xmpp-http-upload
In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hostin…
-
Low —
Buffer overflow in deprecated USB HALs and stack overflow in USB enumeration
### Impact 1) If an application is making use of the deprecated kit protocol HALs as the communication channel to the target device an attacker can masquerade as a device and return malformed packets of arbitrary length which the protocol stack will write to …
-
Low 2.3
Dell XPS 13 9370 BIOS versions prior to 1.13.1 contains an Improper Exception Handling vulnerability. A local attacker …
-
Low 3.5CVE-2020-15228 Public exploit
Environment Variable Injection in GitHub Actions
In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands,…