2020-10-10

CVE-2020-26948 Oct 10, 21:15 CRITICAL POC THREAT Act Now

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-26935 Oct 10, 19:15 CRITICAL POC PATCH THREAT Act Now

An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2020-26945 Oct 10, 20:15 HIGH PATCH This Week

MyBatis before 3.5.6 mishandles deserialization of object streams. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2020-26947 Oct 10, 21:15 HIGH PATCH This Week

monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2020-26934 Oct 10, 19:15 MEDIUM PATCH This Month

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2020-26932 Oct 10, 18:15 MEDIUM This Month

debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode 4750 (for access by the sympa group). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.