6873 matches found
OPENSUSE-SU-2020:0676-1 Security update for autoyast2
This update for autoyast2 to version 4.1.15 fixes the following issues: Security issue fixed: - CVE-2019-18905: Removed all '--gpg-auto-import-keys' options from zypper commands bsc1140711. Non-security issue fixed: - Fix desktop files updating some icons and groups bsc1168123. - Restored some...
CVE-2020-10060
In updatehubprobe, right after JSON parsing is complete, objects\1 is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an...
PT-2020-11890
Name of the Vulnerable Software and Affected Versions zephyrproject-rtos zephyr versions 2.1.0 through 2.2.0 and later versions. Description The issue occurs after JSON parsing is complete in updatehub probe, where accessing objects1 from the output structure can lead to referencing uninitialized...
CVE-2020-11547
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself CPU usage, memory, Windows version, and internal statistics via an HTTP request, as demonstrated by type=probes to login.htm or index.htm...
kernel: oob memory read in hso_probe in drivers/net/usb/hso.c
A flaw was found in the Linux kernel in the function hsoprobe which reads ifnum value from the USB device as an u8 and uses it without a length check to index an array, resulting in an OOB memory read in hsoprobe or hsogetconfigdata. An attacker with a forged USB device and physical access to a...
kernel: oob memory read in hso_probe in drivers/net/usb/hso.c
A flaw was found in the Linux kernel in the function hsoprobe which reads ifnum value from the USB device as an u8 and uses it without a length check to index an array, resulting in an OOB memory read in hsoprobe or hsogetconfigdata. An attacker with a forged USB device and physical access to a...
AMD Downplays CPU Threat Opening Chips to Data Leak Attacks
AMD is seeking to downplay side-channel attacks that can leak potentially sensitive data from its processors released between 2011 and 2019. The “Take A Way” attack, so-called by researchers with the Graz University of Technology in a new analysis this weekend, is a side-channel attack...
AMD Downplays CPU Threat Opening Chips to Data Leak Attacks
AMD is seeking to downplay side-channel attacks that can leak potentially sensitive data from its processors released between 2011 and 2019. The “Take A Way” attack, so-called by researchers with the Graz University of Technology in a new analysis this weekend, is a side-channel attack...
9 Years of AMD Processors Vulnerable to 2 New Side-Channel Attacks
AMD processors from as early as 2011 to 2019 carry previously undisclosed vulnerabilities that open them to two new different side-channel attacks, according to a freshly published research. Known as "Take A Way," the new potential attack vectors leverage the L1 data L1D cache way predictor in...
Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2020-5560)
The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5560 advisory. 2.6.39-400.320.1 - rds: Avoid flushing MRs in rdsrdmadropkeys aru kolappan Orabug: 30650888 - media: b2c2-flexcop-usb: add sanity checking Oliver Neukum...
CVE-2019-10546
Buffer overflow can occur in WLAN firmware while parsing beacon/proberesponse frames during roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wire...
CVE-2019-10546
CVE-2019-10546 describes a buffer overflow in WLAN firmware when parsing beacon/probe_response frames during roaming on Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, and others including APQ8096/.. SXR2130). Affected hardware spans numerous Snapdragon SoCs, including IPQ/MDM/SDM fam...
PT-2020-9066
Name of the Vulnerable Software and Affected Versions Snapdragon Auto versions APQ8096 through SM8250 Snapdragon Compute versions APQ8096 through SM8250 Snapdragon Connectivity versions APQ8096 through SM8250 Snapdragon Consumer Electronics Connectivity versions APQ8096 through SM8250 Snapdragon...
Promise-probe Command Injection Vulnerability
Promise-probe is a probe module. A command injection vulnerability exists in promise-probe versions prior to 0.10.0. The vulnerability stems from a network system or product not properly filtering specific elements of externally entered data during the construction of executable commands. An...
CVE-2019-10791
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization...
CVE-2019-10791
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization...
CVE-2019-10791
The CVE-2019-10791 issue affects the Node.js module promise-probe. The root cause is lack of sanitization in the file, outputFile and options functions, enabling remote command injection when untrusted input is used. Public references from Red Hat, GHSA, OSV, and Snyk corroborate a severe impact ...
CVE-2019-10791: Improper Neutralization of Special Elements used in an OS Command
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization...
PT-2020-9142
Name of the Vulnerable Software and Affected Versions promise-probe versions prior to 0.10.0 Description The issue allows remote attackers to perform a command injection attack. The file, outputFile, and options functions can be controlled by users without any sanitization. Recommendations For...
Buffer overflow
Buffer overflow in the auerswaldprobe function in the Auerswald Linux USB driver for the Linux kernel before 2.6.27 allows physically proximate attackers to execute arbitrary code, cause a denial of service via a crafted USB device, or take full control of the system...