[SECURITY] [DSA 4645-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4645-1 [email protected] https://www.debian.org/security/ Michael Gilbert March 22, 2020 https://www.debian.org/security/faq -...

Authentication flaw

Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain some information and forge the peer device to send specific packets to the affected device. Due to the improper implementation of the authentication function, attackers can exploit...

CVE-2020-1864

CVE-2020-1864 affects Huawei Secospace AntiDDoS8000 series (V500R001C00, V500R001C20, V500R001C60, V500R005C00). Root cause is improper authentication implementation that allows a remote attacker to obtain information and forge the peer device to send specific packets, enabling connection to the ...

CVE-2020-6426

Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

SuiteCRM .htaccess Protection Mechanism Incorrectly Implemented Vulnerability

SuiteCRM is a free open source customer relationship management application. SuiteCRM is vulnerable to an incorrect implementation of the .htaccess protection mechanism. No detailed vulnerability details are provided at this time...

[SECURITY] Fedora 32 Update: opensmtpd-6.6.4p1-2.fc32

OpenSMTPD is a FREE implementation of the server-side SMTP protocol as defi ned by RFC 5321, with some additional standard extensions. It allows ordinary machines to exchange e-mails with other systems speaking the SMTP protocol. Started out of dissatisfaction with other implementations, OpenSMTP...

Design/Logic Flaw

An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data...

CVE-2020-10571

An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data...

CVE-2019-14303

Ricoh SP C250DN 1.05 devices allow denial of service issue 1 of 3. Some Ricoh printers were affected by a wrong LPD service implementation that lead to a denial of service vulnerability...

Debian DSA-4638-1 : chromium - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2019-19880 Richard Lorenz discovered an issue in the sqlite library. - CVE-2019-19923 Richard Lorenz discovered an out-of-bounds read issue in the sqlite library. - CVE-2019-19925 Richard Lorenz discovered an issue in...

Visma Bug Bounty Program: [IDOR]Ability to Pause & Resume the Invoice of other users If GUID is known.

Insecure Direct Object Reference IDOR vulnerability is discovered via a certain endpoint and the application exposes a reference to an internal implementation object. It reveals the real identifier and format/pattern used of the element in the storage backend side...

Node.js: Node.js: TLS session reuse can lead to hostname verification bypass

The Node.js TLS library supports client side reuse of TLS sessions when multiple connections to the same server are opened. Code that wants to use this feature can listen for the 'session' event https://nodejs.org/api/tls.htmltlseventsession on a tls.TLSSocket to get notified of newly created TLS...

CVE-2019-18863

The CVE-2019-18863 entry concerns a key-length vulnerability in the SRTP 128-bit key implementation on Mitel 6800/6900 SIP phones (versions 5.1.0.2051 SP2 and earlier). The root cause is in the SRTP key handling, enabling a man-in-the-middle attack when SRTP is used in a call, with potential inte...

CVE-2018-21035

CVE-2018-21035 affects Qt’s WebSocket implementation in Qt up to 5.14.1, where frames and messages are limited to 2 GB and this limit cannot be configured, enabling potential memory-based DoS. The vulnerability is documented across multiple advisories (e.g., MiracleLinux, Rocky Linux, AlmaLinux, ...

PT-2021-6496 · Libde265 +4 · Libde265 +4

Name of the Vulnerable Software and Affected Versions: libde265 version 1.0.4 Description: The issue is related to a heap buffer overflow in the ff hevc put unweighted pred 8 sse function. This can be exploited via a crafted file, potentially allowing a remote attacker to access confidential data...

[SECURITY] Fedora 31 Update: golang-github-gorilla-websocket-1.4.1-1.fc31

Gorilla WebSocket is a Go implementation of the WebSocket protocol...

[SECURITY] Fedora 30 Update: golang-github-gorilla-websocket-1.4.1-1.fc30

A WebSocket implementation for Go...

CVE-2020-3165 Cisco NX-OS Software Border Gateway Protocol MD5 Authentication Bypass Vulnerability

A vulnerability in the implementation of Border Gateway Protocol BGP Message Digest 5 MD5 authentication in Cisco NX-OS Software could allow an unauthenticated, remote attacker to bypass MD5 authentication and establish a BGP connection with the device. The vulnerability occurs because the BGP MD...

Lark Technologies: Access to private file's of helpdesk.

A improperly implemented access controls vulnerability was found at a Larksuite endpoint that could have resulted in a team founder who was also an admin of a separate helpdesk, to view an arbitrary image from a ticket they did not have permission to view. We thank @imrannisar for reporting this ...

Faraday presents the latest version of their Security Platform for Vulnerability Management Automation

Miami, February 19, 2020 - Faraday is opening 2020 by strengthening their releases using the featured cybersecurity worldwide events calendar, starting next week with BSides and RSAC in San Francisco. As a Blackhat Global Partner, the company will also participate as a sponsor in all BH’s global...