Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-18194PUBLISHED: 2021-05-17Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post.
CVE-2020-18195PUBLISHED: 2021-05-17Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page."
CVE-2020-18198PUBLISHED: 2021-05-17Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."
CVE-2020-21831PUBLISHED: 2021-05-17A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_handles ../../src/decode.c:2637.
CVE-2020-21842PUBLISHED: 2021-05-17A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode.c:3051.
0 Comments
Tweet This
User Rank: Strategist
8/15/2018 | 2:41:39 PM
Singling this out as an open-source problem is insufficiently precise. The valid points made here have less to do with open source per se than they do with overall software supply chain.
Further, most closed-source projects are themselves built on top of many layers of open-source components - from Linux to Apache http to Cygwin to the broad spectrum of libraries. This is especially true for security appliances. With open source, you and others can at least verify that you're using current, patched versions of those components - and quickly upgrade them to respond to vulnerabilities, instead of waiting for your vendor's next quarterly/yearly patch/certification cycle.
As a FOSS advocate, it would have been more even-handed of you to have included points such as these as part of your analysis.