PT-2020-19598 · Music Player Daemon · Mpd

Name of the Vulnerable Software and Affected Versions: MPD versions prior to 5.9 Description: The issue allows a remote attacker who can send specifically crafted PPP authentication messages to cause the daemon to read beyond an allocated memory buffer, resulting in a denial of service condition...

PT-2020-5105 · Linux +7 · Linux Kernel +7

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.9-rc7 Description: The issue is related to a flaw in the Linux kernel's implementation of biovecs, which can cause the kernel to enter an infinite loop when a zero-length biovec request is issued by the block...

Security Bulletin: A Security Vulnerability Has Been Identified In IBM Security Secret Server (CVE-2020-4459)

Summary A security vulnerability identified on IBM Security Secret Server has been addressed in the release 10.8. Vulnerability Details CVEID: CVE-2020-4459 DESCRIPTION: IBM Security Verify Access contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own...

CVE-2020-2574

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

[R1] SimpleSAMLPHP Stand-alone Patch Available for Tenable.sc versions 5.9.x to 5.12.x

Tenable.sc leverages third-party software to help provide underlying functionality. One of the third-party components SimpleSAMLPHP was found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable opted to...

CVE-2018-10854

cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field...

Solaris 7/8/9 (SPARC) - 'dtprintinfo' Local Privilege Escalation (1)

/ raptordtprintnamesparc.c - dtprintinfo 0day, Solaris/SPARC Copyright c 2004-2019 Marco Ivaldi 0day buffer overflow in the dtprintinfo1 CDE Print Viewer, leading to local root. Many thanks to Dave Aitel for discovering this vulnerability and for his interesting research activities on...

CVE-2018-19865

A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3...

CVE-2018-19865

A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3...

Design/Logic Flaw

A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3...

GE iFix

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GE Equipment: Gigasoft component of iFix Vulnerability: Unsafe ActiveX Control Marked Safe For Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a buffer...

ICSA-18-282-02 Siemens SCALANCE W1750D

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely/public exploits are available Vendor: Siemens Equipment: SCALANCE W1750D Vulnerability: Cryptographic issues 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to decrypt TLS traffic. 3...

Security Bulletin: WebSphere Liberty ORB client vulnerability affects IBM Spectrum LSF Application Center

Summary WebSphere Liberty ORB client vulnerability affects IBM Spectrum LSF Application Center Vulnerability Details CVEID: CVE-2018-1683 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB...

OpenSSH 'auth2-gss.c' User Enumeration Vulnerability - Windows

OpenSSH is prone to a user enumeration vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenSSH 'auth2-gss.c' User Enumeration Vulnerability - Linux

OpenSSH is prone to a user enumeration vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Siemens OpenSSL Vulnerability in Industrial Products (Update E)

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION : Exploitable remotely Vendor : Siemens Equipment : Industrial Products Vulnerability : Cleartext Transmission of Sensitive Information 2. UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-18-226-02 Siemens...

Security Bulletin: A vulnerability in the GSKit component of IBM Tivoli Storage Manager for Space Management (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM Tivoli Storage Manager for Space Management IBM Spectrum Protect for Space Management. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused b...

Security Bulletin: IBM Security Access Manager Appliance is affected by an encryption vulnerability (CVE-2017-1473)

Summary IBM Security Access Manager Appliance has addressed the following weak encryption vulnerability. Vulnerability Details CVEID: CVE-2017-1473 DESCRIPTION: IBM Security Access Manager Appliance uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly...

Security Bulletin: Vulnerability in Open Source GNU glibc affects IBM OS Images for Red Hat Linux Systems. (CVE-2015-5277)

Summary A vulnerability in Open Source GNU glibc affects IBM OS Images for Red Hat Linux Systems. Vulnerability Details CVEID: CVE-2015-5277 DESCRIPTION: GNU C Library glibc could allow a local attacker to gain elevated privileges on the system, caused by a heap corruption error in the nssfiles...

PT-2018-3011 · Red Hat · Cloudforms

Name of the Vulnerable Software and Affected Versions: CloudForms versions 5.8 through 5.9 Description: A flaw was found in CloudForms's v2v infrastructure mapping delete feature, allowing for a stored cross-site scripting attack due to improper sanitization of user input in the Name field. The...