Product:

Backports_sle

(Opensuse)
Repositories • https://github.com/opencontainers/runc
• https://github.com/lighttpd/lighttpd1.4
#Vulnerabilities 326
Date Id Summary Products Score Patch Annotated
2020-09-21 CVE-2020-6571 Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Debian_linux, Fedora, Chrome, Backports_sle, Leap 4.3
2020-09-21 CVE-2020-6573 Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Debian_linux, Fedora, Chrome, Backports_sle, Leap 9.6
2020-09-21 CVE-2020-6574 Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalation via a crafted binary. Debian_linux, Fedora, Chrome, Backports_sle, Leap 7.8
2020-09-21 CVE-2020-6575 Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Debian_linux, Fedora, Chrome, Backports_sle, Leap 8.3
2020-09-21 CVE-2020-6576 Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Debian_linux, Fedora, Chrome, Backports_sle, Leap 8.8
2020-10-05 CVE-2020-8228 A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times. Preferred_providers, Backports_sle, Leap 5.3
2020-10-07 CVE-2020-26164 In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack. Kdeconnect, Backports_sle, Leap 5.5
2020-10-10 CVE-2020-26934 phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link. Debian_linux, Fedora, Backports_sle, Leap, Phpmyadmin 6.1
2020-10-10 CVE-2020-26935 An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query. Debian_linux, Fedora, Backports_sle, Leap, Phpmyadmin 9.8
2020-10-14 CVE-2020-15229 Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs`, it is possible to overwrite/create any files on the host filesystem during the extraction with a crafted squashfs filesystem. The extraction occurs automatically for unprivileged (either installation or with `allow setuid = no`) run of Singularity when a user attempt to run an image which is a... Backports_sle, Leap, Singularity 9.3