Archive
25 November 2020
Vulnerabilities first published on this day (UTC), newest first.
12 results · Feed
-
Unscored —
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supp…
-
Unscored —
scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user.
-
Unscored —
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a D…
-
Unscored —CVE-2020-29070 Public exploit
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of …
-
High 7.7
Any GLPI CalDAV calendars is read-only for every authenticated user
GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read…
-
High 7.5
Memory leak in nanopb
Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dyn…
-
Unscored —
A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machin…
-
Unscored —
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering…
-
Unscored —
A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires us…
-
Medium 5.3
Erroneous Proof of Work calculation in geth
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). Th…
-
Medium 6.5
Shallow copy bug in geth
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-comp…
-
Medium 6.5
Denial of service in geth
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.18, there is a Denial-of-service (crash) during block processing. This is fixed in 1.9.18.