HCL Notes security vulnerabilities

HCL Notes is a local email client from HCL India. A stack buffer overflow vulnerability exists in the handling of input parameters in HCL Notes v9. An attacker can exploit this vulnerability to cause the program to crash or inject code into the system that will execute with the privileges of the...

CVE-2020-0477

In sendLinkConfigurationChangedBroadcast of ClientModeImpl.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of the current network configuration with no additional execution privileges needed. User interaction is n...

(0Day) Eaton EASYsoft E70 File Parsing Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Eaton EASYsoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of E70...

Adobe Photoshop Heap Buffer Overflow

The vulnerability of the Adobe Photoshop graphic editor is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in the context of the current user...

Magento Commerce Code Execution

The vulnerability of the Magento Commerce development and management software platform relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

PDF viewer Heap Buffer Overflow DoS

The vulnerability of PDF viewer applications such as Adobe Reader and Document Cloud, as well as Adobe Acrobat and Document Cloud’s PDF editing programs, lies in the issue of writing beyond the buffer limits in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitra...

PDF Viewer Privilege Escalation

The vulnerability of PDF viewer applications such as Adobe Reader and Document Cloud, as well as Adobe Acrobat and Document Cloud’s PDF editing programs, relates to bypassing security features. Exploiting this vulnerability allows a malicious actor to enhance their privileges in the context of th...

Adobe Reader Path Traversal

The vulnerability of the Adobe Reader text viewer is related to errors that occur when restricting access to the path to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to gain access to protected information in the context of the current user...

Magento Commerce Auth Bypass RCE

The vulnerability of the Magento Commerce development and management software platform is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

Slackware 14.2 / current : p11-kit (SSA:2020-347-01)

New p11-kit packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2020-347-01. The text itself is copyright C Slackware Linux, Inc...

Microsoft Excel XLS File Parsing Integer Signedness Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Excel. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XLS...

Microsoft Chakra LinearScan Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Chakra. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the JIT compiler...

CVE-2020-24440

Adobe Prelude version 9.0.1 and earlier is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Apple macOS CoreText MorxLigatureSubtableBuilder TTF Parsing Out-of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the CoreText library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing o...

Adobe InDesign Buffer Overflow RCE

The vulnerability of Adobe InDesign’s computer layout automation tool is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, using a specially crafted file...

Adobe InDesign Buffer Overflow RCE

The vulnerability of Adobe InDesign’s computer layout automation tool is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, using a specially crafted file...

[slackware-security] seamonkey

New seamonkey packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/seamonkey-2.53.5.1-i686-1slack14.2.txz: Upgraded. This update contains security fixes and improvements. For more information, see:...

USN-4661-1 snapcraft vulnerability

It was discovered that Snapcraft includes the current directory when configuring LDLIBRARYPATH for application commands. If a user were tricked into installing a malicious snap or downloading a malicious library, under certain circumstances an attacker could exploit this to affect strict mode sna...

CVE-2020-29074

scan.c in x11vnc 0.9.16 uses IPCCREAT|0777 in shmget calls, which allows access by actors other than the current user...

IBM DB2 Arbitrary Code Execution Vulnerability

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM DB2 suffers from an arbitrary code execution vulnerability that can be exploited by an attacker to...