kernel: Null pointer dereference in the sound/usb/line6/pcm.c

A NULL pointer dereference flaw was found in the way the LINE6 drivers in the Linux kernel allocated buffers for USB packets. This flaw allows an attacker with physical access to the system to crash the system...

Libosinfo: osinfo-install-script option leaks password via command line argument

A flaw was found in libosinfo, version 1.5.0, where the script for automated guest installations, 'osinfo-install-script', accepts user and admin passwords via command line arguments. This could allow guest passwords to leak to other system users via a process listing...

python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

PT-2020-12610 · Phpmyadmin +2 · Phpmyadmin +2

Name of the Vulnerable Software and Affected Versions: phpMyAdmin version 5.0.2 Description: The issue allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. The vendor states that they do not see anything...

CVE-2020-6797

By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact...

[SECURITY] Fedora 30 Update: dcraw-9.28.0-9.fc30

This package contains dcraw, a command line tool to decode raw image data downloaded from digital cameras...

Important: Red Hat Security Advisory: ipmitool security update

An update for ipmitool is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2020-10789

openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php...

Design/Logic Flaw

openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php...

Linux: Get network devices (KB)

nmcli is a command-line tool for controlling NetworkManager and getting its status. It is not meant as a replacement of nm-applet or other similar clients. Rather it Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C b...

PayloadsAllTheThings

This repository is an offensive tool for API key and bucket S3 exploitation. It contains tools and exploits for various types of attacks, including CRLF injection, CSRF injection, and API key leaks. The repository includes a variety of scripts and modules for different types of attacks, such as...

CVE-2020-5252

The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...

Tellabs Optical Line Terminal Authorization Issue Vulnerability

Tellabs Optical Line Terminal OLI is an optical line terminal product from Tellabs, Inc. An authorization issue vulnerability exists in Tellabs OLT 1150 FP version 29.2015873, which can be exploited by an attacker to execute commands...

ONAP CLI Authorization Issues Vulnerability

The ONAP CLI is a command line interface for controlling ONAP from the ONAP project. An authorization issue vulnerability exists in ONAP CLI Dublin and prior versions. An attacker can exploit this vulnerability on ports 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271 to gain...

RLSA-2020:0903 Important: zsh security update

The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell the Korn shell, but includes many enhancements. Zsh supports command-line editing, built-in spelling correction, programmable command completion, shell...

CVE-2019-19335

During installation of an OpenShift 4 cluster, the openshift-install command line tool creates an auth directory, with kubeconfig and kubeadmin-password files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions...

CVE-2020-9326

BeyondTrust Privilege Management for Windows and Mac aka PMWM; formerly Avecto Defendpoint 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments with PowerShell .ps1 file extensions present, leading to a DefendpointService.exe crash...

Design/Logic Flaw

BeyondTrust Privilege Management for Windows and Mac aka PMWM; formerly Avecto Defendpoint 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments with PowerShell .ps1 file extensions present, leading to a DefendpointService.exe crash...

The vulnerability of the Linux operating system’s kernel exists due to the lack of measures taken to neutralize special elements used in the operating system’s command line. This allows attackers to execute arbitrary code.

The vulnerability of the Linux operating system’s kernel exists because measures to neutralize special elements used in the operating system commands have not been implemented. Exploiting this vulnerability allows an attacker to execute arbitrary code...

RICOH SP C250DN Denial of Service Vulnerability

The RICOH SP C250DN is a printer from the Japanese company Ricoh RICOH. A security vulnerability exists in the Ricoh SP C250DN version 1.05, which stems from the program failing to properly implement the LPD service. An attacker could exploit the vulnerability to cause a denial of service...