🚨 CVE-2020-25844
The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege.

🎖@cveNotify

🚨 CVE-2020-29165
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remotely gaining administrator privileges.

🎖@cveNotify

🚨 CVE-2020-29166
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure.

🎖@cveNotify

🚨 CVE-2021-25778
In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.

🎖@cveNotify

🚨 CVE-2021-25759
In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.

🎖@cveNotify

🚨 CVE-2021-25766
In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.

🎖@cveNotify

🚨 CVE-2021-25771
In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.

🎖@cveNotify

🚨 CVE-2021-25777
In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.

🎖@cveNotify

🚨 CVE-2020-27222
In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because it sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshakes failure with TLS parameter mismatch. The server must be restarted to recover this. This allow clients to force a DoS.

🎖@cveNotify

🚨 CVE-2020-35481
SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.

🎖@cveNotify

🚨 CVE-2020-27994
SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.

🎖@cveNotify

🚨 CVE-2020-28653
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.

🎖@cveNotify

🚨 CVE-2020-35667
JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.

🎖@cveNotify

🚨 CVE-2021-25765
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.

🎖@cveNotify

🚨 CVE-2021-25770
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.

🎖@cveNotify

🚨 CVE-2021-25776
In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.

🎖@cveNotify

🚨 CVE-2020-35482
SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.

🎖@cveNotify

🚨 CVE-2020-25208
In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.

🎖@cveNotify

🚨 CVE-2020-28895
In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.

🎖@cveNotify

🚨 CVE-2020-29582
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

🎖@cveNotify

🚨 CVE-2020-2506
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to obtain control of a QNAP device. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

🎖@cveNotify