Total
32264 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-7958 | 1 Oneplus | 2 Oneplus 7 Pro, Oneplus 7 Pro Firmware | 2024-11-21 | 2.1 LOW | 6.0 MEDIUM |
| An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user (root) in the Rich Execution Environment (REE) to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the Trusted Application (TA) supports an extended number of commands beyond what is needed to implement a fingerprint authentication system compatible with Android. An attacker who is in the position to send commands to the TA (for example, the root user) is able to send a sequence of these commands that will result in the TA sending a raw fingerprint image to the REE. This means that the Trusted Execution Environment (TEE) no longer protects identifiable fingerprint data from the REE. | |||||
| CVE-2020-7952 | 1 Valvesoftware | 1 Dota 2 | 2024-11-21 | 6.8 MEDIUM | 7.8 HIGH |
| rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is affected by memory corruption. | |||||
| CVE-2020-7950 | 1 Valvesoftware | 1 Dota 2 | 2024-11-21 | 6.8 MEDIUM | 7.8 HIGH |
| meshsystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a vulnerable function call. | |||||
| CVE-2020-7949 | 1 Valvesoftware | 1 Dota 2 | 2024-11-21 | 6.8 MEDIUM | 7.8 HIGH |
| schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a GetValue call. | |||||
| CVE-2020-7943 | 1 Puppet | 3 Puppet Enterprise, Puppet Server, Puppetdb | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13 | |||||
| CVE-2020-7941 | 1 Plone | 1 Plone | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission. | |||||
| CVE-2020-7938 | 1 Plone | 1 Plone | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level. | |||||
| CVE-2020-7931 | 1 Jfrog | 1 Artifactory | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template. | |||||
| CVE-2020-7927 | 1 Mongodb | 1 Ops Manager | 2024-11-21 | 4.0 MEDIUM | 8.1 HIGH |
| Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2. | |||||
| CVE-2020-7914 | 1 Jetbrains | 1 Intellij Idea | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 2019.3. | |||||
| CVE-2020-7905 | 1 Jetbrains | 1 Intellij Idea | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network. | |||||
| CVE-2020-7815 | 2 Microsoft, Tobesoft | 2 Windows, Xplatform | 2024-11-21 | 7.5 HIGH | 7.8 HIGH |
| XPLATFORM v9.2.260 and eariler versions contain a vulnerability that could allow remote files to be downloaded by setting the arguments to the vulnerable method. this can be leveraged for code execution. File download vulnerability in ____COMPONENT____ of TOBESOFT XPLATFORM allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: TOBESOFT XPLATFORM 9.2.250 versions prior to 9.2.260 on Windows. | |||||
| CVE-2020-7803 | 2 Imgtech, Microsoft | 2 Zoneplayer, Windows | 2024-11-21 | 6.8 MEDIUM | 7.8 HIGH |
| IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution. | |||||
| CVE-2020-7791 | 1 I18n Project | 1 I18n | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs. | |||||
| CVE-2020-7777 | 1 Jsen Project | 1 Jsen | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable. In particular the required field of the schema is not properly sanitized. The resulting string that is build based on the schema definition is then passed to a Function.apply();, leading to an Arbitrary Code Execution. | |||||
| CVE-2020-7772 | 1 Doc-path Project | 1 Doc-path | 2024-11-21 | 10.0 HIGH | 7.5 HIGH |
| This affects the package doc-path before 2.1.2. | |||||
| CVE-2020-7765 | 1 Google | 1 Firebase\/util | 2024-11-21 | 5.0 MEDIUM | 5.6 MEDIUM |
| This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. | |||||
| CVE-2020-7761 | 1 Absolunet | 1 Kafe | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails. | |||||
| CVE-2020-7754 | 1 Npmjs | 1 Npm-user-validate | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters. | |||||
| CVE-2020-7742 | 1 Simpl-schema Project | 1 Simpl-schema | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects the package simpl-schema before 1.10.2. | |||||