magic vulnerabilities

Products

• asyncpg 1
• edeveloper 1

Latest magic CVEs

Newest publication first

1. CVE-2020-17446 Asyncpg Arbitrary Code Execution Via Access to an Uninitialized Pointer

   Published 2020-08-12

   Critical·CVSS 9.8 EPSS 2.4%

   asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.

2. CVE-2001-1448 Magic eDeveloper Enterprise Edition 8.30-5 and earlier allows local users to overwrite arbitrary files and possibly execute code via a symlink attack on temporary files created by the (1) mkuserproc,....

   Published 2005-04-21

   Medium·CVSS 4.6 EPSS 0.55%

   Magic eDeveloper Enterprise Edition 8.30-5 and earlier allows local users to overwrite arbitrary files and possibly execute code via a symlink attack on temporary files created by the (1) mkuserproc, (2) mgrnt, and (3) mgdatasrvr.sc scripts.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.