com.cronutils:cron-utils-spring (1.0.1), de.skuzzle.inject:guice-async-extension (>=0.1.0, <=0.3.0) +1 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (3.1.6)

com.cronutils:cron-utils MAVEN version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - com.cronutils:cron-utils-spring 1.0.1 - de.skuzzle.inject:guice-async-extension =0.1.0, =0.0.2, =0.0.4 Source...

Elastic: Async search stores authorization headers in clear text

Summary: The .async-search index stores the results of async searches. It also stores a copy of the requests authorization headers, in clear text. These clear text authorization headers are then available to anyone with access to .async-search, probably mostly super users. Description: While you...

org.eclipse.jetty.aggregate:jetty-all (11.0.0.beta1), org.eclipse.jetty.demos:demo-async-rest-server (11.0.0.beta2) +21 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (>=11.0.0.beta1, <=11.0.0.beta2)

org.eclipse.jetty:jetty-webapp MAVEN version =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta2 and more Source cves: CVE-2020-27216 Source advisory: GHSA-G3WG-6MCF-8JJ6...

org.scala-steward:scala-steward-core_2.13 (>=0.6.0, <=0.7.0) potentially affected by CVE-2020-11612 via org.http4s:http4s-async-http-client_2.13 (>=0.21.4, <=0.21.7)

org.http4s:http4s-async-http-client2.13 MAVEN version =0.21.4, =0.6.0, =0.7.0 Source cves: CVE-2020-11612 Source advisory: GHSA-8HXH-R6F7-JF45...

edu.gemini:gsp-core-ephemeris_2.12 (>=0.1.3, <=0.1.7), edu.gemini:gsp-core-ocs2_2.12 (>=0.1.3, <=0.1.7) +1 more potentially affected by CVE-2020-11612 via org.http4s:http4s-async-http-client_2.12 (>=0.21.0-m6, <=0.21.1)

org.http4s:http4s-async-http-client2.12 MAVEN version =0.21.0-m6, =0.1.3, =0.1.3, =0.1.7 - org.scala-steward:scala-steward-core2.12 0.5.0 Source cves: CVE-2020-11612 Source advisory: GHSA-8HXH-R6F7-JF45...

org.scala-steward:scala-steward-core_2.13 (>=0.6.0, <=0.7.0) potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.13 (>=0.21.4, <=0.21.7)

org.http4s:http4s-async-http-client2.13 MAVEN version =0.21.4, =0.6.0, =0.7.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

edu.gemini:gsp-core-ephemeris_2.12 (>=0.1.3, <=0.1.7), edu.gemini:gsp-core-ocs2_2.12 (>=0.1.3, <=0.1.7) +1 more potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.12 (>=0.21.0-m6, <=0.21.1)

org.http4s:http4s-async-http-client2.12 MAVEN version =0.21.0-m6, =0.1.3, =0.1.3, =0.1.7 - org.scala-steward:scala-steward-core2.12 0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

GHSA-8HXH-R6F7-JF45 Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

Unbreakable Enterprise kernel security update

4.1.12-124.42.3 - can: peakusb: pcanusbfd: Fix info-leaks to USB devices Tomas Bortoli Orabug: 31351221 CVE-2019-19535 - media: hdpvr: Fix an error handling path in hdpvrprobe Arvind Yadav Orabug: 31352053 CVE-2017-16644 - fs/binfmtmisc.c: do not allow offset overflow Thadeu Lima de Souza Cascard...

Sandbox Breakout / Arbitrary Code Execution in value-censorship

All versions of value-censorship are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code. Recommendation No fix is currently available. Consider using an alternative package until a f...

PT-2020-21596

Name of the Vulnerable Software and Affected Versions value-censorship versions affected versions not specified Description The issue concerns the failure to validate async function constructors, allowing attackers to execute arbitrary code, which can lead to Remote Code Execution. Recommendation...

SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2020:2069-1)

This update for webkit2gtk3 fixes the following issues : Update to version 2.28.3 bsc1173998 : + Enable kinetic scrolling with async scrolling. + Fix web process hangs on large GitHub pages. + Bubblewrap sandbox should not attempt to bind empty paths. + Fix threading issues in the media player. +...

Security update for webkit2gtk3 (important)

openSUSE Security Update: Security update for webkit2gtk3 Announcement ID: openSUSE-SU-2020:1064-1 Rating: important References: 1173998 Cross-References: CVE-2020-13753 CVE-2020-9802 CVE-2020-9803 CVE-2020-9805 CVE-2020-9806 CVE-2020-9807 CVE-2020-9843 CVE-2020-9850 Affected Products: openSUSE...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2020:1992-1)

This update for webkit2gtk3 fixes the following issues : Update to version 2.28.3 bsc1173998 : + Enable kinetic scrolling with async scrolling. + Fix web process hangs on large GitHub pages. + Bubblewrap sandbox should not attempt to bind empty paths. + Fix threading issues in the media player. +...

Telerik UI RadAsyncUpload Arbitrary File Upload Code Execution

The vulnerability of the Telerik UI software for ASP.NET AJAX is related to the shortcomings of the RadAsyncUpload encryption mechanism. Exploiting this vulnerability allows a malicious actor to perform arbitrary file uploads or execute arbitrary code...

Clipboardme - Grab And Inject Clipboard Content By Link

Grab/Inject Clipboard Content Browsers are implementing a new JavaScript API for asynchronous clipboard access to integrate copy and paste into web applications. It is a replacement for the synchronous execCommand-based copy & paste. Async Clipboard requests doesn't block the page while waiting t...

Exploit for Injection in Oracle Agile_Plm

CVE-2019-2725 CVE-2019-2725CNVD-C-2019-48814、WebLogic wls9-async 命令回显 10.3.6 12.1.3 ResultBaseExec.java 用于测试defineClass，将把恶意类从base64还原出来，执行代码，主要是比较方便（可用可不用）。 JDK7u21.java 会生成weblogic-2019-272512.1.3命令执行.txt中的xml，请使用jdk6编译。 CVE-2019-2725.py 检测命令是否会执行。...

OPENSUSE-SU-2020:0357-1 Security update for salt

This update for salt fixes the following issues: - Avoid possible user escalation upgrading salt-master bsc1157465 CVE-2019-18897 - Fix unit tests failures in testbatchasync tests - Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU...

SUSE-SU-2020:0684-1 Security update for salt

This update for salt fixes the following issues: - Avoid possible user escalation upgrading salt-master bsc1157465 CVE-2019-18897 - Fix unit tests failures in testbatchasync tests - Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU...