CVE-2020-28374

In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a...

buf (>=0.1.0, <=0.2.1), i-o (>=0.1.0, <=0.4.1) +2 more potentially affected by CVE-2021-25907 via containers (>=0.1.1, <=0.8.5)

containers CARGO version =0.1.1, =0.1.0, =0.1.0, =0.13.0, =0.14.1 - lude 0.1.0 Source cves: CVE-2021-25907 Source advisory: OSV:RUSTSEC-2021-0010...

[SECURITY] Fedora 33 Update: nodejs-14.15.4-1.fc33

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

CVE-2021-22492: Buffer Copy without Checking Size of Input

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 Broadcom Bluetooth chipsets software. The Bluetooth UART driver has a buffer overflow. The Samsung ID is SVE-2020-18731 January 2021...

PT-2021-4833

Name of the Vulnerable Software and Affected Versions NPort IAW5250A-6I/O affected versions not specified Description The issue is related to information disclosure. It may allow a remote attacker to disclose web server information. Recommendations At the moment, there is no information about a...

PT-2021-4831

Name of the Vulnerable Software and Affected Versions NPort IAW5250A-6I/O affected versions not specified Description The issue is related to information disclosure. It may allow a remote attacker to access confidential information or modify the device's firmware. Recommendations At the moment,...

PT-2021-4832

Name of the Vulnerable Software and Affected Versions NPort IAW5250A-6I/O affected versions not specified Description The issue is related to the use of a hardcoded cryptographic key in the NPort IAW5250A-6I/O serial interface converter. Exploitation of this issue may allow a remote attacker to...

Denial Of Service (DoS)

opensmtpd is vulnerable to denial of service. The smtpd/lkafilter.c, in certain configurations, allows remote attackers to cause a denial of service via a NULL pointer dereference and daemon crash using a malicious pattern of client activity as the filter state machine does not properly maintain...

CVE-2020-35680

smtpd/lkafilter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between th...

Null pointer dereference

smtpd/lkafilter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between th...

CVE-2020-35680

smtpd/lkafilter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between th...

CVE-2020-25153

The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords...

CVE-2020-25196

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication...

CVE-2020-25190

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext...

CVE-2020-25198

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies...

Authentication flaw

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication...

Session fixation

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies...

Code injection

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext...

Authorization

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization...

CVE-2020-25196

The CVE-2020-25196 issue affects MOXA NPort IAW5000A-I/O Series where the built-in WEB server in firmware 2.1 or lower allows SSH/Telnet sessions, potentially enabling brute-force authentication to bypass access controls. Affected product: NPort IAW5000A-I/O Series (Firmware Version 2.1 or lower)...