Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,527 results · page 61 of 111
Dec 16, 2020The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35190 · Other software · Plone · reported by MITRECritical 9.8
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user.CVE-2020-35186 · Other software · Docker · reported by MITRECritical 9.8
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official composer docker images before 1.8.3 contain a blank password for a root user.CVE-2020-35184 · Other software · Docker · reported by MITRECritical 9.8
The official composer docker images before 1.8.3 contain a blank password for a root user. System using the composer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Composer Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35189 · Other software · Kong · reported by MITRECritical 9.8
The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System using the kong docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Kong Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35187 · Other software · Influxdata · reported by MITRECritical 9.8
The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. System using the telegraf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Telegraf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35185 · Other software · Docker · reported by MITRECritical 9.8
The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Ghost Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user.CVE-2020-35469 · Other software · Softwareag · reported by MITRECritical 9.8
The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versions of the Terracotta Server OSS container may allow a remote attacker to achieve root access with a blank password.
- Product
- Terracotta Server OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Appbase streams Docker image 2.1.2 contains a blank password for the root user.CVE-2020-35468 · Other software · Appbase · reported by MITRECritical 9.8
The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams container may allow a remote attacker to achieve root access with a blank password.
- Product
- Streams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35193 · Other software · Sonarsource · reported by MITRECritical 9.8
The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Sonarqube Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user.CVE-2020-35467 · Other software · Docker · reported by MITRECritical 9.8
The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Docker Docs container may allow a remote attacker to achieve root access with a blank password.
- Product
- Docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Blackfire Docker image through 2020-12-14 contains a blank password for the root user.CVE-2020-35466 · Other software · Blackfire · reported by MITRECritical 9.8
The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Blackfire container may allow a remote attacker to achieve root access with a blank password.
- Product
- Blackfire Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user.CVE-2020-35464 · Other software · Weave · reported by MITRECritical 9.8
Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the Weave Cloud Agent container may allow a remote attacker to achieve root access with a blank password.
- Product
- Cloud Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user.CVE-2020-35463 · Other software · Instana · reported by MITRECritical 9.8
Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed using affected versions of the Instana Dynamic APM container may allow a remote attacker to achieve root access with a blank password.
- Product
- Dynamic APM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user.CVE-2020-35462 · Other software · Coscale Agent Project · reported by MITRECritical 9.8
Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the CoScale agent container may allow a remote attacker to achieve root access with a blank password.
- Product
- Coscale Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2020Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user.CVE-2020-29591 · Other software · Docker · reported by MITRECritical 9.8
Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the registry container may allow a remote attacker to achieve root access with a blank password.
- Product
- Registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020A flaw was found in ImageMagick in coders/txt.c.CVE-2020-27758 · Other software · Imagemagick · reported by Red HatLow 3.3
A flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long long`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the raCVE-2020-27757 · Other software · Imagemagick · reported by Red HatLow 3.3
A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the range of type unsigned long long. The flaw could be triggered by a crafted input file under certain conditions when it is processed by ImageMagick. Red Hat Product Security marked this as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case. This flaw affects ImageMagick versions prior to 7.0.8-68.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behaviorCVE-2020-27756 · Other software · Imagemagick · reported by Red HatMedium 5.5
In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead to undefined behavior. This flaw can be triggered by a crafted input file processed by ImageMagick and could impact application availability. The patch uses multiplication in addition to the function `PerceptibleReciprocal()` in order to prevent such divide-by-zero conditions. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size CVE-2020-27755 · Other software · Imagemagick · reported by Red HatLow 3.3
in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the size in the event there is an invalid size. The patch resets the depth to a proper size before throwing an exception. The memory leak can be triggered by a crafted input file that is processed by ImageMagick and could cause an impact to application reliability, such as denial of service. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Dec 8, 2020In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick proceCVE-2020-27754 · Other software · Imagemagick · reported by Red HatLow 3.3
In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick processes a crafted input file. To mitigate this, the patch introduces and uses the ConstrainPixelIntensity() function, which forces the pixel intensities to be within the proper bounds in the event of an overflow. This flaw affects ImageMagick versions prior to 6.9.10-69 and 7.0.8-69.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file.CVE-2020-27753 · Other software · Imagemagick · reported by Red HatMedium 5.5
There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file. These leaks could potentially lead to an impact to application availability or cause a denial of service. It was originally reported that the issues were in `AcquireMagickMemory()` because that is where LeakSanitizer detected the leaks, but the patch resolves issues in the MIFF coder, which incorrectly handles data being passed to `AcquireMagickMemory()`. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Dec 8, 2020A flaw was found in ImageMagick in MagickCore/quantum-private.h.CVE-2020-27752 · Other software · Imagemagick · reported by Red HatHigh 7.1
A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Dec 8, 2020A flaw was found in ImageMagick in MagickCore/quantum-export.c.CVE-2020-27751 · Other software · Imagemagick · reported by Red HatLow 3.3
A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long long` as well as a shift exponent that is too large for 64-bit type. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h.CVE-2020-27750 · Other software · Imagemagick · reported by Red HatMedium 5.5
A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` and math division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020In CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all functions in /MagickCoreCVE-2020-25676 · Other software · Imagemagick · reported by Red HatMedium 5.5
In CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all functions in /MagickCore/pixel.c, there were multiple unconstrained pixel offset calculations which were being used with the floor() function. These calculations produced undefined behavior in the form of out-of-range and integer overflows, as identified by UndefinedBehaviorSanitizer. These instances of undefined behavior could be triggered by an attacker who is able to supply a crafted input file to be processed by ImageMagick. These issues could impact application availability or potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020In the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsets was causing undefinCVE-2020-25675 · Other software · Imagemagick · reported by Red HatLow 3.3
In the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsets was causing undefined behavior in the form of integer overflow and out-of-range values as reported by UndefinedBehaviorSanitizer. Such issues could cause a negative impact to application availability or other problems related to undefined behavior, in cases where ImageMagick processes untrusted input data. The upstream patch introduces functionality to constrain the pixel offsets and prevent these issues. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overfloCVE-2020-25674 · Other software · Imagemagick · reported by Red HatMedium 5.5
WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overflow. This occurs because it is possible for the colormap to have less than 256 valid values but the loop condition will loop 256 times, attempting to pass invalid colormap data to the event logger. The patch replaces the hardcoded 256 value with a call to MagickMin() to ensure the proper value is used. This could impact application availability when a specially crafted input file is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due CVE-2020-25667 · Other software · Imagemagick · reported by Red HatMedium 5.5
TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due to improper string handling, when a crafted input file is provided to ImageMagick. The patch uses a StringInfo type instead of a raw C string to remedy this. This could cause an impact to availability of the application. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Dec 8, 2020There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations.CVE-2020-25666 · Other software · Imagemagick · reported by Red HatLow 3.3
There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. This occurs in the rgb values and `count` value for a color. The patch uses casts to `ssize_t` type for these calculations, instead of `int`. This flaw could impact application reliability in the event that ImageMagick processes a crafted input file. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256.CVE-2020-25665 · Other software · Imagemagick · reported by Red HatMedium 5.5
The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This can cause a out-of-bounds read later on in the routine. The patch adds 256 to bytes_per_row in the call to AcquireQuantumMemory(). This could cause impact to reliability. This flaw affects ImageMagick versions prior to 7.0.8-68.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 8, 2020In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopCVE-2020-25664 · Other software · Imagemagick · reported by Red HatMedium 6.1
In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when PopShortPixel() from MagickCore/quantum-private.h is called. The patch fixes the calls by adding 256 to rowbytes. An attacker who is able to supply a specially crafted image could affect availability with a low impact to data integrity. This flaw affects ImageMagick versions prior to 6.9.10-68 and 7.0.8-68.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
Dec 8, 2020A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READCVE-2020-25663 · Other software · Imagemagick · reported by Red HatMedium 5.5
A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Dec 8, 2020The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29602 · Other software · Irssi · reported by MITRECritical 9.8
The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user. System using the irssi docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official notary docker images before signer-0.6.1-1 contain a blank password for a root user.CVE-2020-29601 · Other software · Docker · reported by MITRECritical 9.8
The official notary docker images before signer-0.6.1-1 contain a blank password for a root user. System using the notary docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Notary Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official spiped docker images before 1.5-alpine contain a blank password for a root user.CVE-2020-29581 · Other software · Docker · reported by MITRECritical 9.8
The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Spiped Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official storm Docker images before 1.2.1 contain a blank password for a root user.CVE-2020-29580 · Other software · Docker · reported by MITRECritical 9.8
The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Storm Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user.CVE-2020-29579 · Other software · Express-gateway · reported by MITRECritical 9.8
The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
- Product
- Express-gateway Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official znc docker images before 1.7.1-slim contain a blank password for a root user.CVE-2020-29577 · Other software · ZNC · reported by MITRECritical 9.8
The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- ZNC Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user.CVE-2020-29576 · Other software · Eggheads · reported by MITRECritical 9.8
The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Eggdrop Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29575 · Other software · Docker · reported by MITRECritical 9.8
The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir Linux Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Elixir Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user.CVE-2020-29564 · Other software · Hashicorp · reported by MITRECritical 9.8
The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Consul Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29578 · Other software · Matomo · reported by MITRECritical 9.8
The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
- Product
- Piwik Fpm-alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2020ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files.CVE-2020-29599 · Other software · Imagemagick · reported by MITREHigh 7.8
ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.cominsert-script.blogspot.com
Dec 4, 2020A flaw was found in ImageMagick in MagickCore/gem-private.h.CVE-2020-27773 · Other software · Imagemagick · reported by Red HatLow 3.3
A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` or division by zero. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 4, 2020A flaw was found in ImageMagick in coders/bmp.c.CVE-2020-27772 · Other software · Imagemagick · reported by Red HatLow 3.3
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned int`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 4, 2020A flaw was found in ImageMagick in MagickCore/statistic.c.CVE-2020-27776 · Other software · Imagemagick · reported by Red HatLow 3.3
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned long. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 4, 2020A flaw was found in ImageMagick in MagickCore/quantum.h.CVE-2020-27775 · Other software · Imagemagick · reported by Red HatLow 3.3
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 4, 2020A flaw was found in ImageMagick in MagickCore/statistic.c.CVE-2020-27774 · Other software · Imagemagick · reported by Red HatLow 3.3
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 4, 2020In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for theCVE-2020-27771 · Other software · Imagemagick · reported by Red HatLow 3.3
In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex() to ssize_t type to avoid this bug. This undefined behavior could be triggered when ImageMagick processes a crafted pdf file. Red Hat Product Security marked this as Low severity because although it could potentially lead to an impact to application availability, no specific impact was demonstrated in this case. This flaw affects ImageMagick versions prior to 7.0.9-0.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 4, 2020Due to a missing check for 0 value of `replace_extent`, it is possible for offset `p` to overflow in SubstituteString(), causing potential impact to applicationCVE-2020-27770 · Other software · Imagemagick · reported by Red HatMedium 5.5
Due to a missing check for 0 value of `replace_extent`, it is possible for offset `p` to overflow in SubstituteString(), causing potential impact to application availability. This could be triggered by a crafted input file that is processed by ImageMagick. This flaw affects ImageMagick versions prior to 7.0.8-68.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.