🚨 CVE-2020-5240
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
🎖@cveNotify
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
🎖@cveNotify
GitHub
Prevent unauthorized users managing others' device · labd/wagtail-2fa@ac23550
This adds a permissions check on the device list and delete views. When
a user has the 'change_user' permission, they are allowed to view
and delete other users' 2FA devices...
a user has the 'change_user' permission, they are allowed to view
and delete other users' 2FA devices...
🚨 CVE-2020-10564
An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call.
🎖@cveNotify
An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call.
🎖@cveNotify
GitHub
CVE/WP-File-Upload_disclosure_report at master · beerpwn/CVE
CVE, reports, research. Contribute to beerpwn/CVE development by creating an account on GitHub.
🚨 CVE-2020-10565
grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part of a memrw command (read_* or write_*) by a guest through a grub2.cfg file. This allows an untrusted guest to perform arbitrary read or write operations in the context of the grub-bhyve process, resulting in code execution as root on the host OS.
🎖@cveNotify
grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part of a memrw command (read_* or write_*) by a guest through a grub2.cfg file. This allows an untrusted guest to perform arbitrary read or write operations in the context of the grub-bhyve process, resulting in code execution as root on the host OS.
🎖@cveNotify
🚨 CVE-2020-10566
grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overflow.
🎖@cveNotify
grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overflow.
🎖@cveNotify
🚨 CVE-2020-10567
An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter. (A potential fast patch is to disable the save_img action in the config file.)
🎖@cveNotify
An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter. (A potential fast patch is to disable the save_img action in the config file.)
🎖@cveNotify
GitHub
remote code execution vulnerability in ajax_calls.php in save_img action because of no validation on extension name. · Issue #600…
after taking another look at your application i noticed in the ajax_calls.php file in the "save_img" action that the "name" parameter doesn't validate the extension of the f...
🚨 CVE-2020-10568
The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings.
🎖@cveNotify
The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings.
🎖@cveNotify
Medium
Sitepress Multilingual CMS WPlugin (WPML) < 4.3.7-b.2
A vulnerability in the Sitepress Multilingual CMS WordPress plugin (WPML) leads to remote code execution by opening a link
🚨 CVE-2020-10571
An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.
🎖@cveNotify
An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.
🎖@cveNotify
GitHub
v1.9.4 by kyamagu · Pull Request #198 · psd-tools/psd-tools
[compression] Security fix, affected versions are 1.8.37 - 1.9.3.
🚨 CVE-2020-10573
An issue was discovered in Janus through 0.9.1. janus_audiobridge.c has a double mutex unlock when listing private rooms in AudioBridge.
🎖@cveNotify
An issue was discovered in Janus through 0.9.1. janus_audiobridge.c has a double mutex unlock when listing private rooms in AudioBridge.
🎖@cveNotify
GitHub
Fixed double unlock when listing private rooms in AudioBridge by lminiero · Pull Request #1988 · meetecho/janus-gateway
Ref: CVE-2020-10573
We've been notified about a double unlock that could happen when sending a "list" request to a AudioBridge instance hosting private rooms. Indeed, whil...
We've been notified about a double unlock that could happen when sending a "list" request to a AudioBridge instance hosting private rooms. Indeed, whil...
🚨 CVE-2020-10574
An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn't actually exist during a "query_logger" Admin API request, because of a typo in the JSON validation.
🎖@cveNotify
An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn't actually exist during a "query_logger" Admin API request, because of a typo in the JSON validation.
🎖@cveNotify
GitHub
Fixed typo in querylogger_parameters (copy/paste error) by lminiero · Pull Request #1989 · meetecho/janus-gateway
Ref: CVE-2020-10574
We've been notified about a typo in the JSON validation of the "query_logger" Admin API request, that could lead to trying to use a string that doesn&a...
We've been notified about a typo in the JSON validation of the "query_logger" Admin API request, that could lead to trying to use a string that doesn&a...
🚨 CVE-2020-10575
An issue was discovered in Janus through 0.9.1. plugins/janus_videocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times.
🎖@cveNotify
An issue was discovered in Janus through 0.9.1. plugins/janus_videocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times.
🎖@cveNotify
GitHub
Several fixes to session management in VideoCall plugin by lminiero · Pull Request #1994 · meetecho/janus-gateway
Ref: CVE-2020-10575
We've been notified about some issues in the VideoCall plugin, specifically some race conditions that could lead to crashes in Janus. After some investigations, this see...
We've been notified about some issues in the VideoCall plugin, specifically some race conditions that could lead to crashes in Janus. After some investigations, this see...
🚨 CVE-2020-10576
An issue was discovered in Janus through 0.9.1. plugins/janus_voicemail.c in the VoiceMail plugin has a race condition that could cause a server crash.
🎖@cveNotify
An issue was discovered in Janus through 0.9.1. plugins/janus_voicemail.c in the VoiceMail plugin has a race condition that could cause a server crash.
🎖@cveNotify
GitHub
Fixes to leaks and race conditions in VoiceMail plugin by lminiero · Pull Request #1993 · meetecho/janus-gateway
Ref: CVE-2020-10576
We've been notified about some issues with the VoiceMail plugin, which in part didn't surprise me as it hasn't been touched much since it was first creat...
We've been notified about some issues with the VoiceMail plugin, which in part didn't surprise me as it hasn't been touched much since it was first creat...
🚨 CVE-2020-10577
An issue was discovered in Janus through 0.9.1. janus.c has multiple concurrent threads that misuse the source property of a session, leading to a race condition when claiming sessions.
🎖@cveNotify
An issue was discovered in Janus through 0.9.1. janus.c has multiple concurrent threads that misuse the source property of a session, leading to a race condition when claiming sessions.
🎖@cveNotify
GitHub
Fix rare race condition when claiming sessions by lminiero · Pull Request #1990 · meetecho/janus-gateway
Ref: CVE-2020-10577
We've been notified about a rare race condition that can occur when claiming sessions, specifically when a "claim" request for a session happens at the...
We've been notified about a rare race condition that can occur when claiming sessions, specifically when a "claim" request for a session happens at the...
🚨 CVE-2020-10578
An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1.
🎖@cveNotify
An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1.
🎖@cveNotify
🚨 CVE-2020-10587
antiX and MX Linux allow local users to achieve root access via "persist-config --command /bin/sh" because of the Sudo configuration.
🎖@cveNotify
antiX and MX Linux allow local users to achieve root access via "persist-config --command /bin/sh" because of the Sudo configuration.
🎖@cveNotify
🚨 CVE-2020-10591
An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey.
🎖@cveNotify
An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey.
🎖@cveNotify
GitHub
Comparing 1.43.0...1.44.0 · walmartlabs/concord
Concord - workflow orchestration and continuous deployment management - Comparing 1.43.0...1.44.0 · walmartlabs/concord
🚨 CVE-2020-10589
v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/config.json is owned by a low-privileged user but contains commands that are executed as root, after v2rayL.service is restarted via Sudo.
🎖@cveNotify
v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/config.json is owned by a low-privileged user but contains commands that are executed as root, after v2rayL.service is restarted via Sudo.
🎖@cveNotify
🚨 CVE-2020-10588
v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/add.sh and /etc/v2rayL/remove.sh are owned by a low-privileged user but execute as root via Sudo.
🎖@cveNotify
v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/add.sh and /etc/v2rayL/remove.sh are owned by a low-privileged user but execute as root via Sudo.
🎖@cveNotify
🚨 CVE-2020-10594
An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.
🎖@cveNotify
An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.
🎖@cveNotify
GitHub
Status · Issue #484 · jpadilla/django-rest-framework-jwt
Hello there, For a long time now I've honestly thought I'd have the time and energy to come back and work on this project, and I think I still don't. I've not worked on any project ...
🚨 CVE-2020-9290
An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in which FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory.
🎖@cveNotify
An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in which FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory.
🎖@cveNotify
FortiGuard Labs
PSIRT | FortiGuard Labs
🚨 CVE-2019-2058
In libAACdec, there is a possible out of bounds read. This could lead to remote information disclosure, with no additional execution privileges needed. User interaction is needed for exploitation.Product: Android Versions: Android-10 Android ID: A-136089102
🎖@cveNotify
In libAACdec, there is a possible out of bounds read. This could lead to remote information disclosure, with no additional execution privileges needed. User interaction is needed for exploitation.Product: Android Versions: Android-10 Android ID: A-136089102
🎖@cveNotify
🚨 CVE-2019-2088
In StatsService, there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were not enabled, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-143895055
🎖@cveNotify
In StatsService, there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were not enabled, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-143895055
🎖@cveNotify