12588 matches found
SUSE-SU-2020:3478-1 Security update for c-ares
This update for c-ares fixes the following issues: - Version update to 1.17.0 CVE-2020-8277: Fixed a Denial of Service through DNS request bsc1178882 For further details see https://c-ares.haxx.se/changelog.html...
PT-2020-5797
Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions 1.2.0 through 1.2.12 Roundcube Webmail versions 1.3.x through 1.3.15 Roundcube Webmail versions 1.4.x through 1.4.9 Description: An issue was discovered in Roundcube Webmail, where the linkref addindex function in...
OPENSUSE-SU-2020:1990-1 Security update for SDL
This update for SDL fixes the following issues: Security issue fixed: - CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDLblitN.c when called from SDLSoftBlit bsc1141844. This update was imported from the SUSE:SLE-15:Update update project...
Hotfix XS82E004 - For Citrix Hypervisor 8.2
Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.2. Information About this Hotfix Component| Details ---|--- Prerequisite| None Post-update tasks| None Content live patchable| No Baselines for Live Patch| N/A Revision History| Published on Oct 13, 2020...
Workload Balancing 8.2.1 - For Citrix Hypervisor 8.2
Who Should Install This Update? This Workload Balancing virtual appliance update is for customers who use the Workload Balancing feature of Citrix Hypervisor 8.2. It constitutes the following deliverable: File Name| CitrixHypervisor-8.2.1-wlb.xva ---|--- Description| This file provides an updated...
JVN#90729322: Hibernate ORM vulnerable to SQL injection
Hibernate ORM is an ORM framework for Java. Hibernate ORM can be configured hibernate.usesqlcomments to true, which is false by default to add comments to generated SQL statements, aimed at debugging purpose. When hibernate.usesqlcomments is configured to true, malicious input may produce...
Cisco IoT Field Network REST API Insufficient Input Validation Vulnerability
A vulnerability in the REST API of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. ...
Cisco Secure Web Appliance Privilege Escalation Vulnerability
A vulnerability in the log subscription subsystem of Cisco AsyncOS for the Cisco Secure Web Appliance formerly Web Security Appliance could allow an authenticated, local attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of...
DSA-4793-1 firefox-esr - security update
Bulletin has no description...
About the security content of macOS Big Sur 11.0.1
About the security content of macOS Big Sur 11.0.1 This document describes the security content of macOS Big Sur 11.0.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...
Cisco IOS XE Software PROFINET Link Layer Discovery Protocol DoS (cisco-sa-ios-profinet-dos-65qYG3W5)
According to its self-reported version and configuration, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the PROFINET handler for Link Layer Discovery Protocol LLDP messages. An unauthenticated, adjacent attacker can exploit thisby sendi...
OPENSUSE-SU-2020:1929-1 Security update for chromium
This update for chromium fixes the following issues: Update to 86.0.4240.198 boo1178703 - CVE-2020-16013: Inappropriate implementation in V8 - CVE-2020-16017: Use after free in site isolation Update to 86.0.4240.193 boo1178630 - CVE-2020-16016: Inappropriate implementation in base...
OPENSUSE-SU-2020:1922-1 Security update for python-waitress
This update for python-waitress to 1.4.3 fixes the following security issues: - CVE-2019-16785: HTTP request smuggling through LF vs CRLF handling bsc1161088. - CVE-2019-16786: HTTP request smuggling through invalid Transfer-Encoding bsc1161089. - CVE-2019-16789: HTTP request smuggling through...
MGASA-2020-0413 Updated chromium-browser-stable packages fix security vulnerabilities
The chromium-browser-stable package has been updated to 86.0.4240.198 version that fixes multiples security vulnerabilities. From 81.0.4044.138 released on May 9th, 2020 to 86.0.4240.198 version, see upstream advisories...
MGASA-2020-0414 Updated lilypond package fixes a security vulnerability
It was discovered that Lilypond, a program for typesetting sheet music, did not restrict the inclusion of Postscript and SVG commands when operating in safe mode, which could result in the execution of arbitrary code when rendering a typesheet file with embedded Postscript code. CVE-2020-17353...
New ModPipe Point of Sale (POS) Malware Targeting Restaurants, Hotels
Cybersecurity researchers today disclosed a new kind of modular backdoor that targets point-of-sale POS restaurant management software from Oracle in an attempt to pilfer sensitive payment information stored in the devices. The backdoor — dubbed "ModPipe" — impacts Oracle MICROS Restaurant...
JVN#44764844: MELSEC iQ-R Series CPU Modules vulnerable to uncontrolled resource consumption
MELSEC iQ-R series CPU modules provided by Mitsubishi Electric Corporation contain an uncontrolled resource consumption vulnerability CWE-400. According to the developer, in case of "To Use or Not to Use Web Server Settings" in the parameter of CPU modules are set to "Not Use", this issue does no...
PT-2020-11855 · Apple · Macos High Sierra +5
Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.2 iPadOS versions prior to 14.2 macOS Catalina versions prior to 10.15.7 macOS High Sierra versions prior to Security Update 2020-005 macOS Mojave versions prior to Security Update 2020-005 Description: An out-of-boun...
Vulnerability fixed in Adobe Reader Mobile
A vulnerability has been fixed in Adobe Reader Mobile for Android. A malicious party could exploit the vulnerability to gain access to sensitive data in the context of the victim. Adobe has released updates to fix the vulnerability in Reader Mobile 20.9.0. For more information, see:...