Code injection

IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due to an error within the Queue processing function. IBM X-Force ID: 181563...

Saferwall - A Hackable Malware Sandbox For The 21St Century

Saferwall is an open source malware analysis platform. It aims for the following goals: Provide a collaborative platform to share samples among malware researchers. Acts as a system expert, to help researchers generates an automated malware analysis report. Hunting platform to find new malwares...

Unbreakable Enterprise kernel security update

4.14.35-1902.304.6 - bpf: fix sanitation rewrite in case of non-pointers Daniel Borkmann Orabug: 31552243 4.14.35-1902.304.5 - acpi: disallow loading configfs acpi tables when locked down Jason A. Donenfeld Orabug: 31493187 - selftests/bpf: do not run testkmod.sh for UEK5 Alan Maguire Orabug:...

Arista Networks Networks CloudVision Portal IP fragment DoS (SA0037)

The version of Arista Networks CloudVision Portal running on the remote device is affected by a denial of service DoS vulnerability. The Linux kernel is vulnerable to a DoS attack with low rates of specially modified packets targeting IP fragment re-assembly. An remote, unauthenticated attacker c...

The vulnerability in the `hw/rdma/vmw/pvrdma_cmd.c` component of the PVRDMA virtual network adapter driver allows a hacker to trigger a service failure.

The vulnerability in the hw/rdma/vmw/pvrdmacmd.c component of the PVRDMA virtual network adapter’s hardware emulation software, QEMU, is related to pointer assignment errors. Exploiting this vulnerability could allow a remote attacker to cause a service failure by creating CQ/QP objects...

The vulnerability of the `create_cq` and `create_qp` functions in the PVRDMA virtual network adapter emulator for hardware infrastructure emulation software QEMU allows a hacker to induce a service failure.

The vulnerability of the createcq and createqp functions in the PVRDMA virtual network adapter emulator for hardware support in QEMU is related to deficiencies in resource release after the expiration of its useful lifespan. Exploiting this vulnerability can allow an attacker to cause a service...

The vulnerability in the `hw/rdma/rdma_backend.c` component of the PVRDMA virtual network adapter emulator for hardware infrastructure, QEMU, allows a hacker to trigger a service failure.

The vulnerability in the hw/rdma/rdmabackend.c component of the PVRDMA virtual network adapter, within the QEMU hardware emulation software, is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to trigger a service failure...

Arista Networks CloudVision Portal Linux Kernel TCP Multiple DoS (SA0041)

The version of Arista Networks CloudVision Portal running on the remote device is affected by the following denial of service DoS vulnerabilities related to TCP networking in the Linux kernel, which can be exploited by a remote, unauthenticated attacker: - SACK Panic. The TCPSKBCBskb-tcpgsosegs...

kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service

A flaw that allowed an attacker to leak kernel memory was found in the network subsystem where an attacker with permissions to create tun/tap devices can create a denial of service and panic the system...

The vulnerabilities of the functions rx_queue_add_kobject() and netdev_queue_add_kobject() (net/core/net-sysfs.c) in the Linux kernel allow attackers to compromise data integrity.

The vulnerability of the functions rxqueueaddkobject and netdevqueueaddkobject net/core/net-sysfs.c in the Linux kernel is related to errors in pointer counting in the networking subsystem. Exploiting this vulnerability could allow an attacker to compromise data integrity...

dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair()

A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index a UInt is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption...

CVE-2020-1941

A flaw was found in activemq. The webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...

SecGen

This is a Ruby application called SecGen, which generates vulnerable virtual machines for security penetration testing. The application uses Vagrant, Puppet, and Ruby to create randomly vulnerable virtual machines based on a scenario specification. The scenario can specify constraints and...

The vulnerability of the Queue cleanup Plugin, related to the lack of protective measures for website structures, allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability of the Queue cleanup Plugin is related to the lack of protective measures for website structures. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks XSS...

kernel: use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body

A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able to groom system memory to cause kernel memory corruption and possible privilege escalation by abusing a race condition in the IO scheduler...

AZL-6835 CVE-2020-13962 affecting package qt5-qtsvg for versions less than 5.12.11-3

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails...

DEBIAN-CVE-2020-13962

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails...

CVE-2020-13962

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails...

UBUNTU-CVE-2020-13962

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails...

CVE-2020-13962

CVE-2020-13962 affects Qt 5.12.2–5.14.2 as used in unofficial builds of Mumble 1.3.0 and other products. The issue arises from mishandling OpenSSL’s error queue, causing a denial of service to QSslSocket users and, due to error leakage across sessions, potentially disconnecting another session wh...