Design/Logic Flaw

In Tensorflow before version 2.4.0, an attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize. This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. However, dimsize only does a DCHECK to validate the argument and th...

CVE-2020-16000

Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Design/Logic Flaw

A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting...

CVE-2020-8929 Ciphertext integrity weakness in Tink

A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting...

Linux kernel BlueZ implementation denial of service vulnerability

Linux kernel is an open source operating system. A security vulnerability exists in the Linux kernel BlueZ implementation, which can be exploited by a local attacker to submit a special request that can crash the system...

[SECURITY] Fedora 32 Update: createrepo_c-0.16.1-2.fc32

C implementation of Createrepo. A set of utilities createrepoc, mergerepoc, modifyrepoc for generating a common metadata repository from a directory of rpm packages and maintaining it...

Announcing the Zero Trust Deployment Center

Organizations have been digitally transforming at warp speed in response to the way businesses operate and how people work. As a result, digital security teams have been under immense pressure to ensure their environments are resilient and secure. Many have turned to a Zero Trust security model t...

LSN-0072-1: Kernel Live Patch Security Notice

It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A local attacker could possibly use this to expose sensitive information kernel memory. CVE-2020-0067 It was discovered that the Serial CAN interfa...

LSN-0072-1 Kernel Live Patch Security Notice

It was discovered that the F2FS file system implementation in the Linux kernel did not properly perform bounds checking on xattrs in some situations. A local attacker could possibly use this to expose sensitive information kernel memory. CVE-2020-0067 It was discovered that the Serial CAN interfa...

RHEL 6 : chromium-browser (RHSA-2020:4235)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4235 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 86.0.4240.75. Security Fixes:...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4578-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4578-1 advisory. Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket reuse, leading to a use-after-free...

CVE-2018-20243

The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629...

Information disclosure

The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629...

CVE-2018-20243

The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629...

[SECURITY] Fedora 31 Update: golang-github-andybalholm-brotli-1.0.1-1.fc31

This package is a brotli compressor and decompressor implemented in Go. It was translated from the reference implementation https://github.com/google/bro tli with the c2go tool at https://github.com/andybalholm/c2go...

[SECURITY] Fedora 32 Update: golang-github-andybalholm-brotli-1.0.1-1.fc32

This package is a brotli compressor and decompressor implemented in Go. It was translated from the reference implementation https://github.com/google/bro tli with the c2go tool at https://github.com/andybalholm/c2go...

Sensitive data exposure in NATS

Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The connection configuration options in these JavaScript-based implementations were...

CVE-2020-6557

Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page...

Directory Traversal

xmpphttpupload is vulnerable to directory traversal. The vulnerability exists through the unsafe implementation of sanitizedjoin, where the .. input can be used to bypass the application root directory...

CVE-2020-7466

The PPP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted PPP authentication message to cause the daemon to read beyond allocated memory buffer, which would result in a denial of service condition...