FreeBSD : drupal -- Multiple Vulnerabilities (95d9d986-1078-11eb-ab74-4c72b94353b5)

Drupal Security Team reports : The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrin...

FreeBSD : Flash Player -- arbitrary code execution (42926d7b-0da3-11eb-8dbd-6451062f0f7a)

Adobe reports : - This update resolves a NULL pointer dereference vulnerability that could lead to arbitrary code execution CVE-2020-9746. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020...

FreeBSD : Rails -- Possible XSS vulnerability (95f306a6-0aee-11eb-add4-08002728f74c)

Ruby on Rails blog : Rails version 6.0.3.4 has been released! This version is a security release and addresses one possible XSS attack vector in Actionable Exceptions. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

FreeBSD : Payara -- A Polymorphic Typing issue in FasterXML jackson-databind (bd159669-0808-11eb-a3a4-0019dbb15b3f)

Payara Releases reports : The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases : - CVE-2019-12086 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before...

FreeBSD : Payara -- path trasversal flaw via either loc/con parameters in Eclipse Mojarra (b07bdd3c-0809-11eb-a3a4-0019dbb15b3f)

Payara Releases reports : The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases : - CVE-2020-6950 Eclipse Mojarra vulnerable to path trasversal flaw via either loc/con parameters C...

FreeBSD : payara -- multiple vulnerabilities (71c71ce0-0805-11eb-a3a4-0019dbb15b3f)

Payara Releases reports : The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases : - CVE-2018-14721 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct...

FreeBSD : chromium -- multiple vulnerabilities (64988354-0889-11eb-a01b-e09467587c17)

Chrome releases reports : This release contains 35 security fixes, including : - 1127322 Critical CVE-2020-15967: Use after free in payments. Reported by Man Yue Mo of GitHub Security Lab on 2020-09-11 - 1126424 High CVE-2020-15968: Use after free in Blink. Reported by Anonymous on 2020-09-09 -...

FreeBSD : zeek -- Vulnerability due to memory leak (769a4f60-9056-4c27-89a1-1758a59a21f8)

Jon Siwek of Corelight reports : This release fixes the following security issue : - A memory leak in multipart MIME code has potential for remote exploitation and cause for Denial of Service via resource exhaustion. C Tenable Network Security, Inc. The descriptive text and package checks in this...

FreeBSD : libexif -- multiple vulnerabilities (cff0b2e2-0716-11eb-9e5d-08002728f74c)

Release notes : Lots of fixes exposed by fuzzers like AFL, ClusterFuzz, OSSFuzz and others : CVE-2016-6328: fixed integer overflow when parsing maker notes CVE-2017-7544: fixed buffer overread CVE-2018-20030: Fix for recursion DoS CVE-2019-9278: replaced integer overflow checks the compiler could...

FreeBSD : upnp -- denial of service (crash) (a23871f6-059b-11eb-8758-e0d55e2a8bf9)

CVE mitre reports : Portable UPnP SDK aka libupnp 1.12.1 and earlier allows remote attackers to cause a denial of service crash via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/servicetable/servicetable.c...

SpamTitan 7.07 Remote Code Execution

Exploit Title: SpamTitan 7.07 - Unauthenticated Remote Code Execution Date: 2020-09-18 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: https://www.titanhq.com/spamtitan/spamtitangateway/ Software Link: https://www.titanhq.com/signup/?producttype=spamtitangateway Version: 7.07 Tested on:...

FreeBSD : kdeconnect -- packet manipulation can be exploited in a Denial of Service attack (c71ed065-0600-11eb-8758-e0d55e2a8bf9)

Albert Astals Cid reports : KDE Project Security AdvisoryTitleKDE Connect: packet manipulation can be exploited in a Denial of Service attackRisk RatingImportantCVECVE-2020-26164Versionskdeconnect Date2 October 2020Overview An attacker on your local network could send maliciously crafted packets ...

SpamTitan 7.07 - Unauthenticated Remote Code Execution

Exploit Title: SpamTitan 7.07 - Unauthenticated Remote Code Execution Date: 2020-09-18 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: https://www.titanhq.com/spamtitan/spamtitangateway/ Software Link: https://www.titanhq.com/signup/?producttype=spamtitangateway Version: 7.07 Tested on:...

FreeBSD : tt-rss -- multiple vulnerabilities (2eec1e85-faf3-11ea-8ac0-4437e6ad11c4)

tt-rss project reports : The cachedurl feature mishandles JavaScript inside an SVG document. imgproxy in plugins/afproxyhttp/init.php mishandles $REQUEST'url' in an error message. It does not validate all URLs before requesting them. Allows remote attackers to execute arbitrary PHP code via a...

macOS 10.15.x < 10.15.6 / 10.14.x < 10.14.6 Security Update 2020-004 / 10.13.x < 10.13.6 Security Update 2020-004

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6 Security Update 2020-004, 10.14.x prior to 10.14.6 Security Update 2020-004, or 10.15.x prior to 10.15.6. It is, therefore, affected by multiple vulnerabilities, including the following: - A vulnerability wa...

The vulnerability of the FreeBSD operating system’s kernel, allowing a hacker to execute arbitrary code

The vulnerability of the FreeBSD operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

FreeBSD : Apache Ant leaks sensitive information via the java.io.tmpdir (6d5f1b0b-b865-48d5-935b-3fb6ebb425fc)

Apache reports : Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory bac...

FreeBSD : powerdns -- Leaking uninitialised memory through crafted zone records (b371db92-fe34-11ea-b90e-6805ca2fa271)

PowerDNS Team reports CVE-2020-17482: An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory. Such a user could be a customer inserting data via...

CVE-2020-24718

bhyve, as used in FreeBSD through 12.1 and illumos e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04, does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying...

CVE-2020-24718

bhyve, as used in FreeBSD through 12.1 and illumos e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04, does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying...