Scientific Linux Security Update : evolution on SL7.x x86_64 (20200407)

evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-online-accounts C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

CentOS 7 : evolution (RHSA-2020:1080)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1080 advisory. - GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a...

evolution security and bug fix update

atk 2.28.1-2 - Remove patch to fix invalid unref at atkgobjectaccessibleobjectgonecb - Resolves: 1753123 evolution 3.28.5-8 - Update patch for RH bug 1686408 CVE-2018-15587: Reposition signature bar 3.28.5-7 - Add patch for RH bug 1686408 CVE-2018-15587: Reposition signature bar 3.28.5-6 - Add...

CVE-2020-3890

The issue was addressed with improved deletion. This issue is fixed in iOS 13.4 and iPadOS 13.4. Deleted messages groups may still be suggested as an autocompletion...

CVE-2020-3890

The issue was addressed with improved deletion. This issue is fixed in iOS 13.4 and iPadOS 13.4. Deleted messages groups may still be suggested as an autocompletion...

CVE-2020-3890

CVE-2020-3890 affects Apple iOS/iPadOS Messages Composition: a logic/deletion issue allowed deleted message groups to be suggested as autocompletion. Root cause: deletion handling in Messages Composition. Impact: potential leakage of deleted content via autocomplete suggestions. Mitigation: patch...

Sagemcom [email protected] 3890 (50_10_19-T1) Cable Modem - Cable Haunt Remote Code Execution Exploit

// EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47936.zip function buf2hexbuffer // buffer is an ArrayBuffer return Array.prototype.map.callnew Uint8Arraybuffer, x = '00' + x.toString16.slice-2.join''; function insertAtarr, index, toInsert...

Sagemcom F@ST 3890 (50_10_19-T1) Cable Modem - 'Cable Haunt' Remote Code Execution

// EDB Note: Download https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47936.zip function buf2hexbuffer // buffer is an ArrayBuffer return Array.prototype.map.callnew Uint8Arraybuffer, x = '00' + x.toString16.slice-2.join''; function insertAtarr, index, toInsert...

CVE-2019-19494

Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21T4, Sagemcom F@...

CVE-2019-19494

Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21T4, Sagemcom F@...

Fast8690-exploit

Sagemcom Fast 3890 exploit This exploit uses the Cable Haunt...

RHEL 8 : ghostscript (RHSA-2019:3890)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3890 advisory. The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats ...

evolution security and bug fix update

evolution 3.28.5-9 - Add patch for RH bug 1724984 ECompEditor Ensure attendee changes stored before save 3.28.5-8 - Add patch for RH bug 1724659 Make sure intltool-merge cache is created only once 3.28.5-7 - Add patch for RH bug 1724232 Help Contents F1 has a bad link to GNOME site...

CVE-2019-3890

CVE-2019-3890 affects evolution-ews in Evolution Data Server (before 3.31.3). The flaw: SSL certificate validity is not checked, enabling an attacker to trick users into connecting to a fake server and obtain confidential information. Multiple Nessus entries reference this CVE within various Linu...

Samba 4.8.0 < 4.8.10 / 4.9.x < 4.9.6 / 4.10.0 < 4.10.2 Path/Symlink Traversal Vulnerability (CVE-2019-3890)

The version of Samba running on the remote host is 4.8.x 4.8.11 or 4.9.x 4.9.6 or 4.10.0 prior to 4.10.2. It is, therefore, potentially affected by a path/symlink traversal vulnerability. An authenticated, unpriviledged attacker can exploit this issue anywhere they have unix permissions to create...

Fedora 29 : evolution-data-server / evolution-ews (2019-3a2cc6a0b9)

Security fix for CVE-2019-3890 - SSL Certificates are not validated Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Ubuntu 16.04 LTS / 18.04 LTS : Django vulnerability (USN-3890-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3890-1 advisory. It was discovered that Django incorrectly handled formatting certain numbers. A remote attacker could possibly use this issue to cause Django to consu...

CVE-2018-3890

Summary: CVE-2018-3890 affects Yi Home Camera 27US 1.8.7.0D. A local/physical vulnerability in the firmware update path allows code execution via a crafted SD-card payload. The root cause is in the firmware update workflow: a crafted file triggers a logic flaw and command injection through the ex...

CVE-2015-3890

CVE-2015-3890 applies to Open Litespeed before 1.3.10, described as a use-after-free vulnerability. Multiple connected sources characterize the issue as a memory misreference that could allow remote-triggered crashes or instability; one CNVD entry explicitly calls it a memory misreference vulnera...

Debian DSA-3890-1 : spip - security update

Emeric Boit of ANSSI reported that SPIP, a website engine for publishing, insufficiently sanitises the value from the X-Forwarded-Host HTTP header field. An unauthenticated attacker can take advantage of this flaw to cause remote code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...