5454 matches found
GLSA-202006-20 : Asterisk: Root privilege escalation
The remote host is affected by the vulnerability described in GLSA-202006-20 Asterisk: Root privilege escalation It was discovered that Gentoos Asterisk ebuild does not properly set permissions on its data directories. This only affects OpenRC systems, as the flaw was exploitable via the init...
Asterisk: Root privilege escalation
Background A Modular Open Source PBX System. Description It was discovered that Gentoo’s Asterisk ebuild does not properly set permissions on its data directories. This only affects OpenRC systems, as the flaw was exploitable via the init script. Impact A local attacker could escalate privileges...
Security Bulletin: Vulnerability in MongoDB affects IBM Spectrum Protect Plus (CVE-2019-2389)
Summary A denial of service vulnerability in MongoDB affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-2389 DESCRIPTION: MongoDB Server is vulnerable to a denial of service, caused by a flaw in the SysV init scripts. By inserting a specially-crafted PID file, a remote...
CVE-2020-3230 Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerability
A vulnerability in the Internet Key Exchange Version 2 IKEv2 implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. The vulnerability is due to incorrect handling of crafted IKEv2...
Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerability
A vulnerability in the Internet Key Exchange Version 2 IKEv2 implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. The vulnerability is due to incorrect handling of crafted IKEv2...
openSUSE Security Update : autoyast2 (openSUSE-2020-676)
This update for autoyast2 to version 4.1.15 fixes the following issues : Security issue fixed : - CVE-2019-18905: Removed all '--gpg-auto-import-keys' options from zypper commands bsc1140711. Non-security issue fixed : - Fix desktop files updating some icons and groups bsc1168123. - Restored some...
Security update for autoyast2 (moderate)
openSUSE Security Update: Security update for autoyast2 Announcement ID: openSUSE-SU-2020:0676-1 Rating: moderate References: 1109310 1133045 1140711 1164105 1168123 1168281 1170082 Cross-References: CVE-2019-18905 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and...
The vulnerability of the initDocumentParser function in the Terracotta Quartz Scheduler library, which allows a hacker to execute an XXE attack
The vulnerability of the initDocumentParser function in the Terracotta Quartz Scheduler’s task scheduling library is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute an XXE attack...
Design/Logic Flaw
An issue was discovered in FRRouting FRR aka Free Range Routing through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some...
CVE-2020-12831
CVE-2020-12831 affects FRRouting FRR up to 7.3.1. The issue arises when using the split-config feature: the init script creates an empty config file with world-readable permissions, enabling potential information leakage via tools/frr.in and tools/frrcommon.sh.in. Some sources label this as user ...
CVE-2020-12831
An issue was discovered in FRRouting FRR aka Free Range Routing through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some...
PT-2020-13279 · Frrouting +4 · Frrouting Frr +4
Name of the Vulnerable Software and Affected Versions: FRRouting FRR versions through 7.3.1 Description: An issue was discovered in FRRouting FRR when using the split-config feature. The init script creates an empty config file with world-readable default permissions, leading to a possible...
EulerOS Virtualization for ARM 64 3.0.2.0 : cloud-init (EulerOS-SA-2020-1519)
According to the versions of the cloud-init package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Cloud-init is a set of init scripts for cloud instances. Cloud instances need special scripts to run during...
Huawei EulerOS: Security Advisory for cloud-init (EulerOS-SA-2020-1519)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
kernel: A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c allows for a DoS
A flaw was found in the Linux kernel. The Intel OPA Gen1 driver mishandles resource cleanup. An attacker able to induce low memory condition on the system could use this flaw to crash the system. The highest threat from this vulnerability is to system availability...
kernel: Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c allows for a DoS
A flaw was found in the way the Intel Wireless driver in the Linux kernel handled resource cleanup during Gen 3 device initialization. This flaw allows an attacker with the ability to restrict access to DMA coherent memory on device initialization, to crash the system...
Huawei EulerOS: Security Advisory for cloud-init (EulerOS-SA-2020-1373)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP3 : cloud-init (EulerOS-SA-2020-1373)
According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because...
CVE-2020-11738
The Snap Creek Duplicator plugin before 1.3.28 for WordPress and Duplicator Pro before 3.8.7.1 allows Directory Traversal via ../ in the file parameter to duplicatordownload or duplicatorinit...