PT-2020-3998

Name of the Vulnerable Software and Affected Versions: Intel Core Processor families versions 8th through 10th Generation Description: The issue is related to improper initialization in BIOS firmware, which may allow an unauthenticated user to potentially enable escalation of privilege via local...

Unbreakable Enterprise kernel security update

5.4.17-2011.3.2.1uek - x86/speculation: Add Ivy Bridge to affected list Josh Poimboeuf Orabug: 31352779 CVE-2020-0543 - x86/speculation: Add SRBDS vulnerability and mitigation documentation Mark Gross Orabug: 31352779 CVE-2020-0543 - x86/speculation: Add Special Register Buffer Data Sampling SRBD...

perfetto:trace_processor_fuzzer: Heap-buffer-overflow in perfetto::trace_processor::ClockTracker::ConvertSlowpath

Project: https://android.googlesource.com/platform/external/perfetto/ Detailed Report: https://oss-fuzz.com/testcase?key=6264709723717632 Project: perfetto Fuzzing Engine: libFuzzer Fuzz Target: traceprocessorfuzzer Job Type: libfuzzerasanperfetto Platform Id: linux Crash Type: Heap-buffer-overfl...

Cisco Catalyst 9800 Series Wireless Controllers IOS XE Input Validation Error Vulnerability

Cisco IOS XE is the United States Cisco Cisco company's set of operating system developed for its network equipment. An input validation error vulnerability exists in the Flexible NetFlow version 9 packet processor for IOS XE in Cisco Catalyst 9800 Series Wireless Controllers. An attacker could...

kernel: double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c

A flaw was found in the allocatetracebuffer in kernel/trace/trace.c in the debug subsystem, when failure to allocate a dynamic percpu area, a resource cleanup is called. The pointer buf-buffer still holds the address and is not set to NULL, which can cause a use-after-free problem, leading to a...

Qualys Adds Cloud Agent Linux Support for AWS ARM-Based EC2 Instances

Releasing this week May 26, 2020, Qualys adds Cloud Agent Linux support for Amazon Web Services EC2 instances powered by ARM processors including the new Graviton2 processor. AWS Graviton2 processors power Amazon EC2 M6g, C6g, and R6g instances that provide up to 40% better price performance over...

Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation

A flaw was found in the Linux kernel on s390 architecture. The issue occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade. An inter-processor interrupt IPI is then sent to each active CPU to update the control registers...

Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation

A flaw was found in the Linux kernel on s390 architecture. The issue occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade. An inter-processor interrupt IPI is then sent to each active CPU to update the control registers...

NetApp Service Processor and NetApp Baseboard Management Controller Denial of Service Vulnerabilities

NetApp Service Processor and NetApp Baseboard Management Controller are both products of NetApp, Inc.NetApp Service Processor is a remote management device. The product provides node remote management capabilities, including console redirection, logging, and power control.NetApp Baseboard...

CVE-2019-5500

Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthenticated attacker to cause a Denial of Service DoS...

CVE-2019-5500

Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthenticated attacker to cause a Denial of Service DoS...

CVE-2019-5500

CVE-2019-5500 concerns NetApp’s Service Processor (SV) and Baseboard Management Controller (BMC) firmware. Connected documents confirm a remote, unauthenticated attacker can cause a Denial of Service (DoS) on affected devices. The impact is described as DoS, with CVSS metrics indicating a Network...

CVE-2019-5500: Undefined Security Weakness

Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthenticated attacker to cause a Denial of Service DoS...

PT-2020-11142

Name of the Vulnerable Software and Affected Versions NetApp Service Processor and Baseboard Management Controller firmware affected versions not specified Description The issue allows a remote unauthenticated attacker to cause a Denial of Service DoS. Recommendations At the moment, there is no...

CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

PT-2020-12288

Name of the Vulnerable Software and Affected Versions Hibernate Validator version 6.1.2.Final Description A flaw was found in the message interpolation processor of Hibernate Validator, enabling invalid EL expressions to be evaluated as if they were valid. This allows attackers to bypass input...

qt5-qtimageformats: QTgaFile CPU exhaustion

An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption...

CVE-2020-11884

A flaw was found in the Linux kernel on s390 architecture. The issue occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade. An inter-processor interrupt IPI is then sent to each active CPU to update the control registers...

DEBIAN-CVE-2020-1722

A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password = 1,000,000 characters to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this...

com.shopizer:shopizer-shipping-canadapost-module (>=0.0.1, <=2.11.0), com.shopizer:shopizer-shipping-distance-processor (>=2.0.3, <=2.8.1) +2 more potentially affected by CVE-2020-11007 via com.shopizer:sm-core-model (>=2.0.2, <=2.10.0)

com.shopizer:sm-core-model MAVEN version =2.0.2, =0.0.1, =2.0.3, =2.0.2, =2.6.0, =2.7.0 Source cves: CVE-2020-11007 Source advisory: GHSA-W8RC-PGXQ-X2CJ...