Stack overflow

A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution...

CVE-2019-11849

ALEOS (embedded M2M) prior to version 4.11.0 contains a stack overflow vulnerability in the AT Command API that can enable code execution. The CNVD-2020-48628 entry confirms the issue in ALEOS and specifies the affected component (AT Command API) and the vulnerable range (before 4.11.0). Practica...

PT-2020-9212

Name of the Vulnerable Software and Affected Versions ALEOS versions prior to 4.11.0 Description A stack overflow issue exists in the AT command APIs, which may allow code execution. Recommendations For versions prior to 4.11.0, update to version 4.11.0 or later to resolve the issue...

CVE-2019-11849: Out-of-bounds Write

A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution...

SUSE-SU-2020:2237-1 Security update for libvirt

This update for libvirt fixes the following issues: - CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. - bsc1161883, bsc1174458 - qemu: Setup emulator thread and cpuset.mems before exec - bsc1171946 - libxl:...

BugPoC: Users can Change their Own Email Address

BugPoC uses AWS Cognito for authentication and user pool management. @vasi42 noticed that they were able to use the Cognito API, UpdateUserAttributes, to update their own email address. Calling this API without subsequently calling the VerifyUserAttribute API puts your account into an unverified...

PT-2020-13186

Name of the Vulnerable Software and Affected Versions TinyMCE versions 4.9.10 and earlier TinyMCE versions 5.2.1 and earlier TinyMCE versions 5.4.0 and earlier Description A cross-site scripting XSS vulnerability allows remote attackers to inject arbitrary web script when configured in classic...

CVE-2020-17480

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor...

CVE-2020-17480

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor...

CVE-2020-17480

The CVE-2020-17480 issue affects TinyMCE prior to 4.9.7 and 5.x prior to 5.1.4, where cross-site scripting can be triggered by inserting content via clipboard or editor APIs in the core parser, paste plugin, and visualchars plugin. The vulnerability arises from improper input validation and can b...

CVE-2020-17480

Removed by vendor...

SUSE-SU-2020:2100-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.1.0 ESR Fixed: Various stability, functionality, and security fixes bsc1174538 CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker CVE-2020-6514: WebRTC data channel...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-43609)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxadminapis.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from failure to properly validate user-supplied strings before executing system calls. ...

CentOS Web Panel Code Execution Vulnerability (CNVD-2020-43140)

CentOS Web Panel CWP is a free web hosting control panel that makes it easy to manage multiple servers Dedicated and VPS without having to access the servers via SSH. A code execution vulnerability in CentOS Web Panel version cwp-e17.0.9.8.923, which stems from the ajaxadminapis.php file not...

CVE-2020-15607

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxadminapis.php. When parsing the line parameter, the process does...

Undetectable Linux Malware Targeting Docker Servers With Exposed APIs

Cybersecurity researchers today uncovered a completely undetectable Linux malware that exploits undocumented techniques to stay under the radar and targets publicly accessible Docker servers hosted with popular cloud platforms, including AWS, Azure, and Alibaba Cloud. Docker is a popular...

SQL Injection in Kylin

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries...

Command Injection in Kylin

Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation...

Veeam Service Provider Console v4 Patch 2

Challenge Veeam Service Provider Console v4 Patch 2. Cause Please confirm you are running version 4.0.0.4877 or later before installing this Patch 2. You can check this by logging in to the backup portal and navigating to Configuration Support Information tab. After upgrading, your server build...

Code injection

Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave all versions prior to 2019-11-15 allows a local user to execute arbitrary code in the enclave that can compromise confidentiality of enclave data via APIs that accept invalid pointers...