Deserialization of untrusted data

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic...

CVE-2020-15098

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic...

CVE-2020-15098

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic...

PT-2020-14174

Name of the Vulnerable Software and Affected Versions TYPO3 "mediace" extension versions 7.6.2 through 7.6.4 Description A flaw in the internal verification mechanism of the "mediace" extension allows attackers to generate arbitrary checksums, enabling them to inject arbitrary data with a valid...

Remote Code Execution (RCE)

udp.c in the Linux kernel is vulnerable Remote Code Execution RCE. It allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSGPEEK flag...

(Pwn2Own) Oracle VirtualBox E1000 IP Checksum Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Denial Of Service (DoS)

Kerberos is vulnerable to Denial of Service DoS. Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication mechanisms in certain configuration...

Denial Of Service (DoS)

krb5 is vulnerable to denial of service DoS. The vulnerability exists as a NULL pointer dereference flaw was discovered in the MIT Kerberos Generic Security Service Application Program Interface GSS-API library. A remote, authenticated attacker could use this flaw to crash any server application...

Authorization Bypass

aide is vulnerable to authorization bypass. The vulnerability exists as a flaw was discovered in the way file checksums were stored in the AIDE database. A packaging flaw in the Red Hat AIDE rpm resulted in the file database not containing any file checksum information. This could prevent AIDE fr...

CVE-2019-15795

python-apt only checks the MD5 sums of downloaded files in Version.fetchbinary and Version.fetchsource of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions...

Install Go tools from modules with brew-gomod

As of Go 1.14, modules are ready for production. Compared to GOPATH, they make it much easier to keep workspaces clean by managing dependencies out of sight, and by letting you clone projects anywhere. However, there is no good way to simply install a Go binary from source, yet. The core reason f...

Multiple ESET products ESET AV parsing engine input validation error vulnerability

ESET Smart Security Premium and others are products of ESET Slovakia.Smart Security Premium is a suite of antivirus programs.Internet Security is a suite of antivirus programs for Internet security.NOD32 Antivirus is a suite of antivirus programs.ESET AV The parsing engine is one of the parsing...

CVE-2020-10180

The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro macOS, Cyber Security macOS, Mobile Security for Android, Smart TV Security,...

CVE-2020-10180

The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro macOS, Cyber Security macOS, Mobile Security for Android, Smart TV Security,...

Design/Logic Flaw

The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro macOS, Cyber Security macOS, Mobile Security for Android, Smart TV Security,...

CVE-2020-10180

The CVE-2020-10180 issue concerns the ESET AV parsing engine where a crafted BZ2 Checksum field in an archive bypasses virus detection. Affected products and versions include Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Sec...

CVE-2020-10180

The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro macOS, Cyber Security macOS, Mobile Security for Android, Smart TV Security,...

PT-2020-11959

Name of the Vulnerable Software and Affected Versions ESET Smart Security Premium versions prior to 1294 ESET Internet Security versions prior to 1294 ESET NOD32 Antivirus versions prior to 1294 ESET Cyber Security Pro macOS versions prior to 1294 ESET Cyber Security macOS versions prior to 1294...

CVE-2020-10180: Interpretation Conflict

The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro macOS, Cyber Security macOS, Mobile Security for Android, Smart TV Security,...

USN-4292-1 rsync vulnerabilities

It was discovered that rsync incorrectly handled pointer arithmetic in zlib. An attacker could use this issue to cause rsync to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2016-9840, CVE-2016-9841 It was discovered that rsync incorrectly handled vectors...