OPENSUSE-SU-2020:2048-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: - Fix regression '8250861: Crash in MinINode::IdealPhaseGVN, bool', introduced in October 2020 CPU. - Update to version jdk8u272 icedtea 3.17.0 July 2020 CPU, bsc1174157, and October 2020 CPU, bsc1177943 New features + JDK-8245468: Add...

CVE-2020-29128

petl before 1.68, in some configurations, allows resolution of entities in an XML document...

PYSEC-2020-75

petl before 1.68, in some configurations, allows resolution of entities in an XML document...

Design/Logic Flaw

petl before 1.68, in some configurations, allows resolution of entities in an XML document...

CVE-2020-29128

petl before 1.68, in some configurations, allows resolution of entities in an XML document...

CVE-2020-29128

CVE-2020-29128 concerns the Python ETL library petl, prior to version 1.68. In some configurations, petl can resolve entities in XML input, enabling an attacker to disclose arbitrary files when the application processes attacker-supplied XML with a configured lxml backend. The issue is classified...

CVE-2020-29128: XML Injection (aka Blind XPath Injection)

petl before 1.68, in some configurations, allows resolution of entities in an XML document...

PT-2020-17093

Name of the Vulnerable Software and Affected Versions petl versions prior to 1.68 Description The issue allows resolution of entities in an XML document, potentially leading to information disclosure. An attacker who can submit XML input to an application using petl can disclose arbitrary files o...

Intel RealSense D400 Series Dynamic Calibration Tool Standard Resolution Error

The vulnerability of the dynamic calibration tool for microprogrammed cameras from the Intel RealSense D400 Series lies in errors related to the use of standard resolutions. Exploiting this vulnerability can allow attackers to enhance their privileges...

Hotfix XS80E006 - For Citrix Hypervisor 8.0

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.0. All customers who are affected by the issues described inCTX263477 - Citrix Hypervisor Multiple Security Updatesshould install this hotfix. Ensure that you also installCTX262555 - Hotfix XS80E005 - For...

Hotfix XS81E001 - For Citrix Hypervisor 8.1

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.1. Note : EnsurethatyouuseXenCenter8.1.2orlatertoinstallthishotfix.ThelatestversionofXenCenterisavailablefrom the CitrixHypervisorDownloadsite. Information About this Hotfix Component| Details ---|---...

USN-4638-1: c-ares vulnerability

It was discovered that c-ares incorrectly handled certain DNS requests. An attacker could possibly use this issue to cause a denial of service...

libmaxminddb: Denial of service

Background The libmaxminddb library provides a C library for reading MaxMind DB files, including the GeoIP2 databases from MaxMind. Description libmaxminddb used uninitialised memory when reading from a corrupt database file. Impact A remote attacker could entice a user to use a specially crafted...

2020-11 Cumulative Update for Windows 10 Version 1909 for x64-based Systems (KB4586786)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

Receiver Clean-Up Utility

Important Notes Please note: You can download the required file from the Citrix downloads website by visiting the following link: https://www.citrix.com/downloads/citrix-tools --- Receiver cleanup utility is not required while upgrading to the Receiver forWindows 4.4 or newer. Receiver for Window...

Starbucks: Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sg

ko2sec discovered an .ashx endpoint on mobile.starbucks.com.sg intended for image files permitted unrestricted file type uploads which could lead to a potential RCE. ko2sec's thorough analysis provided additional endpoints on other out of scope domains that shared this vulnerability. @ko2sec —...

CVE-2020-6015: Improper Link Resolution Before File Access

Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent the storage of service log files in non-standard locations...

User has access to project and repository after global permission has been removed

h3. Problem User has access to project and repository after global permission has been removed. Conversely, a user in this affected state will be greeted with "permission denied" even after the global permission has been re-granted to the user. h3. Environment - Tested on 7.5 and 7.3 h3. Steps to...

XXE vulnerability in mercurial

mercurial 2.11 and earlier does not configure its XML changelog parser to prevent XML external entity XXE attacks. This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controlle...

CVE-2020-16007: Improper Link Resolution Before File Access

Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted filesystem...