In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tblgetfield.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.

An inappropriate implementation flaw was found in the JavaScript component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1029576

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An insufficient data validation flaw was found in the streams component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1031895

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An use after free flaw was found in the audio component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1042254

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An inappropriate implementation flaw was found in the Blink component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1024256

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An insufficient policy enforcement flaw was found in the CORS component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1026546

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An incorrect security ui flaw was found in the Omnibox component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1006012

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An inappropriate implementation flaw was found in the CORS component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1038036

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An uninitialized use flaw was found in the PDFium component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1032090

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An insufficient policy enforcement flaw was found in the downloads component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1029375

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An incorrect security ui flaw was found in the sharing component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1027408

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An inappropriate implementation flaw was found in the Skia component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1035271

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An insufficient validation of untrusted input flaw was found in the Blink component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1017871

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An insufficient policy enforcement flaw was found in the extensions component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1030411

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An insufficient policy enforcement flaw was found in the Blink component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1035058

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An insufficient policy enforcement flaw was found in the Blink component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1014371

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

A type confusion flaw was found in the JavaScript component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1031909

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An insufficient policy enforcement flaw was found in the storage component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1035399

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An out of bounds memory access flaw was found in the streams component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1045874

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.

Cacti 1.2.8 has stored XSS in datasources.php, colortemplatesitem.php, graphs.php, graphitems.php, lib/apiautomation.php, useradmin.php, and usergroupadmin.php, as demonstrated by the description parameter in datasources.php (a raw string from the database that is displayed by $header to trigger the XSS).

Last updated 25 August 2025

flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).

Last updated 25 August 2025

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

An integer overflow flaw was found in the JavaScript component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1034394

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

An out of bounds write flaw was found in the SQLite component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1025466

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with nolog on that can lead to leakage of sensible data.

"User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.