Security update for java-1_8_0-openj9 (important)

openSUSE Security Update: Security update for java-180-openj9 Announcement ID: openSUSE-SU-2020:0841-1 Rating: important References: 1169511 1171352 Cross-References: CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805...

ntp: DoS on client ntpd using server mode packet

A flaw was found in the Network Time Protocol NTP, where a security issue exists that allows an off-path attacker to prevent the Network Time Protocol daemon ntpd from synchronizing with NTP servers not using authentication. A server mode packet with a spoofed source address sent to the client nt...

unbound: infinite loop via malformed DNS answers received from upstream servers

A flaw was found in unbound in versions prior to 1.10.1. An infinite loop can be created when malformed DNS answers are received from upstream servers. The highest threat from this vulnerability is to system availability...

Mattermost Server Trust Management Issues Vulnerability (CNVD-2020-35449)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.8.2, prior to 3.7.5, and prior to 3.6.7. An attacker could exploit the vulnerability to bypass X.509 certificate validation f...

Stack overflow

A stack-based buffer overflow in DMitry Deepmagic Information Gathering Tool 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by nicformatbuff...

UBUNTU-CVE-2020-14931

A stack-based buffer overflow in DMitry Deepmagic Information Gathering Tool 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by nicformatbuff...

CVE-2020-14931

A stack-based buffer overflow in DMitry Deepmagic Information Gathering Tool 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by nicformatbuff...

DNS as Code

Infrastructure as Code IaC and Continuous Delivery methods have become increasingly popular amongst development and operations teams as a means of maintaining high-performing websites. Code repositories, build servers, and configuration management systems are now industry standards, as these tool...

CVE-2020-14449

An issue was discovered in Mattermost Mobile Apps before 1.30.0. Authorization tokens can sometimes be disclosed to third-party servers, aka MMSA-2020-0018...

SUSE-SU-2020:1686-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk to version jdk8u252 fixes the following issues: - CVE-2020-2754: Forward references to Nashorn bsc1169511 - CVE-2020-2755: Improve Nashorn matching bsc1169511 - CVE-2020-2756: Better mapping of serial ENUMs bsc1169511 - CVE-2020-2757: Less Blocking Array Queues...

SUSE-SU-2020:1683-1 Security update for java-1_7_1-ibm

This update for java-171-ibm fixes the following issues: java-171-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 65 bsc1172277 and bsc1169511 - CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service - CVE-2020-2756: Improved...

aaPanel Remote Code Execution Vulnerability

aaPanel is a simple but powerful control panel for Linux servers. A remote code execution vulnerability exists in aaPanel 6.6.6 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary commands via the Script Content box on the Add Cron Job interface...

Phishing Campaign Targeting Office 365, Exploits Brand Names

Researchers have discovered a sophisticated new phishing campaign that uses recognized brand names to bypass security filters as well as to trick victims into giving up Microsoft Office 365 credentials to gain access to corporate networks. A new report from Check Point Software first observed the...

PT-2020-4195 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions prior to 8.8.8 Drupal Core versions prior to 8.9.1 Drupal Core version 9.0.1 Description: The issue is related to an arbitrary PHP code execution vulnerability under certain circumstances. An attacker could trick an...

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-005

Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to...

CVE-2020-7500

A CWE-89:Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability exists in U.motion Servers and Touch Panels affected versions listed in the security notification which could cause arbitrary code to be executed when a malicious command is entered...

CVE-2020-7499

A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels affected versions listed in the security notification which could cause unauthorized access when a low privileged user makes unauthorized changes...

CVE-2020-7499

A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels affected versions listed in the security notification which could cause unauthorized access when a low privileged user makes unauthorized changes...

CVE-2020-7500

A CWE-89:Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability exists in U.motion Servers and Touch Panels affected versions listed in the security notification which could cause arbitrary code to be executed when a malicious command is entered...

Authorization

A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels affected versions listed in the security notification which could cause unauthorized access when a low privileged user makes unauthorized changes...