CVE-2020-14778

Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM...

EulerOS Virtualization for ARM 64 3.0.6.0 : python-pillow (EulerOS-SA-2020-2024)

According to the versions of the python-pillow package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.CVE-2020-5311 - In...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2020-54655)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in tensorflow-lite versions prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, and 2.3.1, which can be exploited by an attacker to write and read from outside the...

EulerOS 2.0 SP3 : libexif (EulerOS-SA-2020-2142)

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - exifentrygetvalue in exif-entry.c in libexif 0.6.21 has a divide-by-zero error.CVE-2020-12767 - An issue was discovered in libexif before 0.6.22...

PYSEC-2020-131

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can...

PYSEC-2020-119

In Tensorflow version 2.3.0, the SparseCountSparseOutput and RaggedCountSparseOutput implementations don't validate that the weights tensor has the same shape as the data. The check exists for DenseCountSparseOutput, where both tensors are fully specified. In the sparse and ragged count weights a...

USN-4527-1 linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities

It was discovered that the Conexant 23885 TV card device driver for the Linux kernel did not properly deallocate memory in some error conditions. A local attacker could use this to cause a denial of service memory exhaustion. CVE-2019-19054 It was discovered that the Atheros HTC based wireless...

UBUNTU-CVE-2020-25595

An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't ...

CVE-2020-24625

Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-24625

Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

Directory traversal

Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-24624

Unathenticated directory traversal in the DownloadServlet class execute method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-24625

Summary: CVE-2020-24625 is an unauthenticated directory traversal vulnerability in the ReceiverServlet doGet() of Hewlett Packard Enterprise Pay per Use (PPU) Utility Computing Service (UCS) Meter, up to version 1.9 (vulnerability exists prior to 1.9). The root cause is lack of proper validation ...

CVE-2020-24625

Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-24624

Unathenticated directory traversal in the DownloadServlet class execute method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-24624

CVE-2020-24624 describes an unauthenticated directory traversal in the DownloadServlet class’s execute() method on Hewlett Packard Enterprise’s Pay Per Use (PPU) Utility Computing Service (UCS) Meter, v1.9. The vulnerability allows an attacker to read arbitrary files via an improper validation of...

CVE-2020-24625: Improper Limitation of a Pathname to a Restricted Directory

Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service

By mmaping a FUSE-backed file onto a process's memory containing command line arguments or environment strings, an attacker can cause utilities from psutils or procps such as ps, w or any other program which makes a read call to the /proc//cmdline or /proc//environ files to block indefinitely...

Out Of Bound Reads

Google chrome is vulnerable to out of bound reads. Out of bounds read in SQLite in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

CVE-2020-14029

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files...