Lista CVE - 2020 / Dicembre
Visualizzazione 1401 - 1500 di 1538 CVE per Dicembre 2020 (Pagina 15 di 16)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2020-28413 | 2020-12-30 | In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP. |
| CVE-2020-27534 | 2020-12-30 | util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call. |
| CVE-2020-26296 | 2020-12-30 | XSS in Vega |
| CVE-2020-26291 | 2020-12-30 | Hostname spoofing in URI.js |
| CVE-2020-13654 | 2020-12-31 | XWiki Platform before 12.8 mishandles escaping in the property displayer. |
| CVE-2020-35857 | 2020-12-31 | An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption. |
| CVE-2020-11947 | 2020-12-31 | iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker. |
| CVE-2020-12658 | 2020-12-31 | gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running... |
| CVE-2019-20808 | 2020-12-31 | In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define() routine while handling MMIO write operations through the ati_mm_write() callback. A... |
| CVE-2020-17363 | 2020-12-31 | USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredRequest (aka lasthundredrequestAction) in the Timeline module. NOTE: this may... |
| CVE-2020-19664 | 2020-12-31 | DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi. |
| CVE-2016-9021 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in storeController.php. |
| CVE-2016-9022 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in usersController.php. |
| CVE-2016-9025 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php. |
| CVE-2016-9026 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in fileController.php. |
| CVE-2016-9023 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php. |
| CVE-2018-14067 | 2020-12-31 | Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted payload to the HTTPS port, because lighttpd listens on all network interfaces (including... |
| CVE-2018-16795 | 2020-12-31 | OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php to upload a .php file. |
| CVE-2019-7725 | 2020-12-31 | includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk). |
| CVE-2019-7726 | 2020-12-31 | modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent). |
| CVE-2020-25842 | 2020-12-31 | CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access |
| CVE-2020-25843 | 2020-12-31 | CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow |
| CVE-2020-25844 | 2020-12-31 | CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow |
| CVE-2020-25845 | 2020-12-31 | CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1 |
| CVE-2020-25846 | 2020-12-31 | CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2 |
| CVE-2020-25848 | 2020-12-31 | HGiga MailSherlock - Broken Authentication |
| CVE-2020-25850 | 2020-12-31 | HGiga MailSherlock - Arbitrary File Download |
| CVE-2020-35740 | 2020-12-31 | HGiga MailSherlock - XSS -1 |
| CVE-2020-35741 | 2020-12-31 | HGiga MailSherlock - XSS -2 |
| CVE-2020-35742 | 2020-12-31 | HGiga MailSherlock - SQL Injection -1 |
| CVE-2020-35743 | 2020-12-31 | HGiga MailSherlock - SQL Injection -3 |
| CVE-2020-35851 | 2020-12-31 | HGiga MailSherlock - Command Injection |
| CVE-2020-35928 | 2020-12-31 | An issue was discovered in the concread crate before 0.2.6 for Rust. Attackers can cause an ARCache<K,V> data race by sending types that do not implement Send/Sync. |
| CVE-2020-35927 | 2020-12-31 | An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types. |
| CVE-2020-35926 | 2020-12-31 | An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishandled. |
| CVE-2020-35925 | 2020-12-31 | An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type. |
| CVE-2020-35924 | 2020-12-31 | An issue was discovered in the try-mutex crate before 0.3.0 for Rust. TryMutex<T> allows cross-thread sending of a non-Send type. |
| CVE-2020-35923 | 2020-12-31 | An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust. A NotNan value can contain a NaN. |
| CVE-2020-35922 | 2020-12-31 | An issue was discovered in the mio crate before 0.7.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation. |
| CVE-2020-35921 | 2020-12-31 | An issue was discovered in the miow crate before 0.3.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation. |
| CVE-2020-35920 | 2020-12-31 | An issue was discovered in the socket2 crate before 0.3.16 for Rust. It has false expectations about the std::net::SocketAddr memory representation. |
| CVE-2020-35919 | 2020-12-31 | An issue was discovered in the net2 crate before 0.2.36 for Rust. It has false expectations about the std::net::SocketAddr memory representation. |
| CVE-2020-35918 | 2020-12-31 | An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic. |
| CVE-2020-35917 | 2020-12-31 | An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From<Py<T>>. |
| CVE-2020-35916 | 2020-12-31 | An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.) |
| CVE-2020-35915 | 2020-12-31 | An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust. GenericMutexGuard allows cross-thread data races of non-Sync types. |
| CVE-2020-35914 | 2020-12-31 | An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockWriteGuard unsoundness. |
| CVE-2020-35913 | 2020-12-31 | An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockReadGuard unsoundness. |
| CVE-2020-35912 | 2020-12-31 | An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness. |
| CVE-2020-35911 | 2020-12-31 | An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockReadGuard unsoundness. |
| CVE-2020-35910 | 2020-12-31 | An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedMutexGuard unsoundness. |
| CVE-2020-35909 | 2020-12-31 | An issue was discovered in the multihash crate before 0.11.3 for Rust. The from_slice parsing code can panic via unsanitized data from a network server. |
| CVE-2020-35908 | 2020-12-31 | An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled. |
| CVE-2020-35907 | 2020-12-31 | An issue was discovered in the futures-task crate before 0.3.5 for Rust. futures_task::noop_waker_ref allows a NULL pointer dereference. |
| CVE-2020-35906 | 2020-12-31 | An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situation. |
| CVE-2020-35905 | 2020-12-31 | An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code). |
| CVE-2020-35904 | 2020-12-31 | An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. It has incorrect expectations about the relationship between the memory allocation and how many iterator elements there are. |
| CVE-2020-35903 | 2020-12-31 | An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question. |
| CVE-2020-35902 | 2020-12-31 | An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed. |
| CVE-2020-35901 | 2020-12-31 | An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream. |
| CVE-2020-35900 | 2020-12-31 | An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A pop_back() call may lead to a use-after-free. |
| CVE-2020-35899 | 2020-12-31 | An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data. |
| CVE-2020-35898 | 2020-12-31 | An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data. |
| CVE-2020-35897 | 2020-12-31 | An issue was discovered in the atom crate before 0.3.6 for Rust. An unsafe Send implementation allows a cross-thread data race. |
| CVE-2020-35896 | 2020-12-31 | An issue was discovered in the ws crate through 2020-09-25 for Rust. The outgoing buffer is not properly limited, leading to a remote memory-consumption attack. |
| CVE-2020-35895 | 2020-12-31 | An issue was discovered in the stack crate before 0.3.1 for Rust. ArrayVec has an out-of-bounds write via element insertion. |
| CVE-2020-35894 | 2020-12-31 | An issue was discovered in the obstack crate before 0.1.4 for Rust. Unaligned references can occur. |
| CVE-2020-35893 | 2020-12-31 | An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized memory. |
| CVE-2020-35892 | 2020-12-31 | An issue was discovered in the simple-slab crate before 0.3.3 for Rust. index() allows an out-of-bounds read. |
| CVE-2020-35891 | 2020-12-31 | An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via a remove() double free. |
| CVE-2020-35890 | 2020-12-31 | An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via out-of-bounds access for large capacity. |
| CVE-2020-35889 | 2020-12-31 | An issue was discovered in the crayon crate through 2020-08-31 for Rust. A TOCTOU issue has a resultant memory safety violation via HandleLike. |
| CVE-2020-35888 | 2020-12-31 | An issue was discovered in the arr crate through 2020-08-25 for Rust. Uninitialized memory is dropped by Array::new_from_template. |
| CVE-2020-35887 | 2020-12-31 | An issue was discovered in the arr crate through 2020-08-25 for Rust. There is a buffer overflow in Index and IndexMut. |
| CVE-2020-35886 | 2020-12-31 | An issue was discovered in the arr crate through 2020-08-25 for Rust. An attacker can smuggle non-Sync/Send types across a thread boundary to cause a data race. |
| CVE-2020-35885 | 2020-12-31 | An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust. StrcCtx performs improper memory deallocation. |
| CVE-2020-35884 | 2020-12-31 | An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header. |
| CVE-2020-35883 | 2020-12-31 | An issue was discovered in the mozwire crate through 2020-08-18 for Rust. A ../ directory-traversal situation allows overwriting local files that have .conf at the end of the filename. |
| CVE-2020-35882 | 2020-12-31 | An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race. |
| CVE-2020-35881 | 2020-12-31 | An issue was discovered in the traitobject crate through 2020-06-01 for Rust. It has false expectations about fat pointers, possibly causing memory corruption in, for example, Rust 2.x. |
| CVE-2020-35880 | 2020-12-31 | An issue was discovered in the bigint crate through 2020-05-07 for Rust. It allows a soundness violation. |
| CVE-2020-35879 | 2020-12-31 | An issue was discovered in the rulinalg crate through 2020-02-11 for Rust. There are incorrect lifetime-boundary definitions for RowMut::raw_slice and RowMut::raw_slice_mut. |
| CVE-2020-35878 | 2020-12-31 | An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of the dropping of uninitialized memory. |
| CVE-2020-35877 | 2020-12-31 | An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of out-of-bounds access. |
| CVE-2020-35876 | 2020-12-31 | An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data... |
| CVE-2020-35875 | 2020-12-31 | An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly. |
| CVE-2020-35874 | 2020-12-31 | An issue was discovered in the internment crate through 2020-05-28 for Rust. ArcIntern::drop has a race condition and resultant use-after-free. |
| CVE-2020-35873 | 2020-12-31 | An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free. |
| CVE-2020-35872 | 2020-12-31 | An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type. |
| CVE-2020-35871 | 2020-12-31 | An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race. |
| CVE-2020-35870 | 2020-12-31 | An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free. |
| CVE-2020-35869 | 2020-12-31 | An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings. |
| CVE-2020-35868 | 2020-12-31 | An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification. |
| CVE-2020-35867 | 2020-12-31 | An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module. |
| CVE-2020-35866 | 2020-12-31 | An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor. |
| CVE-2020-35865 | 2020-12-31 | An issue was discovered in the os_str_bytes crate before 2.0.0 for Rust. It has false expectations about char::from_u32_unchecked behavior. |
| CVE-2020-35864 | 2020-12-31 | An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks. |
| CVE-2020-35863 | 2020-12-31 | An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on... |
| CVE-2020-35862 | 2020-12-31 | An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free. |
| CVE-2020-35861 | 2020-12-31 | An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys. |