CVE-2020-11045

Out-of-bounds Read in FreeRDP

In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.

CVSS 3.1 · 2.2 Low EPSS 1.6% KEV · Not listed

Vendors

Canonical Debian Freerdp and 1 more

Products

Ubuntu Linux Debian Linux Freerdp and 1 more

CVE-2020-11044

Double Free in FreeRDP

In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.

CVSS 3.1 · 2.2 Low EPSS 1.7% KEV · Not listed

Vendors

Canonical Debian Freerdp and 1 more

Products

Ubuntu Linux Debian Linux Freerdp and 1 more

CVE-2020-11043

Out-of-bounds Read in FreeRDP

In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset. Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.

CVSS 3.1 · 2.2 Low EPSS 1.9% KEV · Not listed

Vendors

Debian Freerdp Opensuse and 1 more

Products

Debian Linux Freerdp Leap and 1 more

CVE-2020-11042

Out-of-bounds Read in FreeRDP

In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0.

CVSS 3.1 · 5.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Canonical Debian Freerdp and 1 more

Products

Ubuntu Linux Debian Linux Freerdp and 1 more

CVE-2020-11041

Improper Validation of Array Index in FreeRDP

In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.

CVSS 3.1 · 2.2 Low EPSS 1.4% KEV · Not listed

Vendors

Debian Freerdp Opensuse and 1 more

Products

Debian Linux Freerdp Leap and 1 more

CVE-2020-11040

Out-of-bounds Read in FreeRDP

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.

CVSS 3.1 · 2.2 Low EPSS 1.5% KEV · Not listed

Vendors

Debian Freerdp Opensuse and 1 more

Products

Debian Linux Freerdp Leap and 1 more

CVE-2020-11039

Integer Overflow in FreeRDP

In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0.

CVSS 3.1 · 8 High EPSS 1.1% KEV · Not listed

Vendors

Debian Freerdp Opensuse and 1 more

Products

Debian Linux Freerdp Leap and 1 more

CVE-2020-11038

Integer Overflow to Buffer Overflow in FreeRDP

In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.

CVSS 3.1 · 6.9 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Freerdp Opensuse and 1 more

Products

Debian Linux Freerdp Leap and 1 more

CVE-2020-11037

Potential Observable Timing Discrepancy in Wagtail

In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is [understood to be feasible on a local network, but not on the public internet](https://groups.google.com/d/msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ). Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability. This has been patched in 2.7.3, 2.8.2, 2.9.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Torchbox

Products

Wagtail

CVE-2020-11036

XSS in GLPI

In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "<script>alert(1)</script>" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `" onmouseover="alert(document.cookie)` and an empty first name. 2. With this user, create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the "last update" field, put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2020-11035

weak CSRF tokens in GLPI

In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Glpi-project

Products

Fedora Glpi

CVE-2020-11034

bypass of manageRedirect in GLPI

In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6.

CVSS 3.1 · 6.1 Medium EPSS 7.6% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2020-11033

Able to read any token through API user endpoint in GLPI

In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed in version 9.4.6.

CVSS 3.1 · 6.6 Medium EPSS 1.0% KEV · Not listed

Vendors

Fedoraproject Glpi-project

Products

Fedora Glpi

CVE-2020-11032

SQL injection on addme_observer and addme_assign in GLPI

In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.

CVSS 3.1 · 7.6 High EPSS 1.0% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2020-11031

Insecure encryption algorithm in GLPI

In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2020-11030

Cross-site scripting (XSS) in Search block in WordPress

In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

CVSS 3.1 · 6.4 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Wordpress

Products

Debian Linux Wordpress

CVE-2020-11029

Cross-site scripting in stats method (object cache) in WordPress

In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

CVSS 3.1 · 5.8 Medium EPSS 2.1% KEV · Not listed

Vendors

Debian Wordpress

Products

Debian Linux Wordpress

CVE-2020-11028

Unauthenticated disclosure of certain private posts in WordPress

In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

CVSS 3.1 · 5.8 Medium EPSS 2.3% KEV · Not listed

Vendors

Debian Wordpress

Products

Debian Linux Wordpress

CVE-2020-11027

Password reset links invalidation issue in WordPress

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

CVSS 3.1 · 6.1 Medium EPSS 13.6% KEV · Not listed

Vendors

Debian Wordpress

Products

Debian Linux Wordpress

CVE-2020-11026

Specially crafted filenames in WordPress leading to XSS

In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

CVSS 3.1 · 8.7 High EPSS 2.1% KEV · Not listed

Vendors

Debian Wordpress

Products

Debian Linux Wordpress