PT-2020-16135

Name of the Vulnerable Software and Affected Versions Django REST Framework versions prior to 3.12.0 Django REST Framework versions prior to 3.11.2 Description A flaw in Django REST Framework allows for a cross-site-scripting XSS issue when using the browseable API viewer. The framework fails to...

CMONOS.JP vulnerable to cross-site scripting

Overview CMONOS.JP provided CMONOS Co. Ltd. is a content management system CMS. CMONOS.JP contains a stored cross-site scripting vulnerability CWE-79. stypr of Flatt Security Inc. reported this vulnerability to the developer and coordinated on his own. After coordination was completed, this case...

MGASA-2020-0372 Updated nodejs packages fix security vulnerabilities

The nodejs package has been updated to the latest version in the 10.x branch, which is 10.22.1 at this time. It fixes several security issues and other bugs. See the upstream changelog and advisories for details...

DLA-2384-1 yaws - security update

Bulletin has no description...

DLA-2378-1 openssl1.0 - security update

Bulletin has no description...

Cisco IOS XE Software Arbitrary Code Execution Vulnerability

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to execute persistent code at boot time and break the chain of trust. This vulnerability is due to incorrect validations by boot scripts when specific ROM monitor ROMMON variables are set. An attacker could...

Cisco IOS XE Software for Catalyst 9200 Series Switches Umbrella Connector Denial of Service Vulnerability

A vulnerability in the Umbrella Connector component of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to trigger a reload, resulting in a denial of service condition on an affected device. The vulnerability is due to insufficient erro...

Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Trap Denial of Service Vulnerability

A vulnerability in Simple Network Management Protocol SNMP trap generation for wireless clients of the Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause the device to unexpectedly reload, causing a denial of...

Cisco IOS XE Software RESTCONF and NETCONF-YANG Access Control List Denial of Service Vulnerability

A vulnerability in the RESTCONF and NETCONF-YANG access control list ACL function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect processing of the ACL that is tied to the RESTCONF or NETCONF-YANG featur...

Cisco IOS XE Software Command Injection Vulnerability

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to inject a command to the underlying operating system that will execute with root privileges upon the next reboot of the device. The authenticated user must have privileged EXEC permissions on the...

Cisco IOS XE Software Consent Token Bypass Vulnerability

A vulnerability in the persistent Telnet/Secure Shell SSH CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system OS with root privileges. The vulnerability is due to insufficient...

Cisco IOS XE Software Arbitrary Code Execution Vulnerability

A vulnerability in the implementation of the Lua interpreter that is integrated in Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code with root privileges on the underlying Linux operating system OS of an affected device. The vulnerability is due to...

Cisco IOS Software for Cisco Industrial Routers Virtual-LPWA Unauthorized Access Vulnerability

A vulnerability in the implementation of the Low Power, Wide Area LPWA subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Industrial ISRs and Cisco 1000 Series Connected Grid Routers CGR1000 could allow an unauthenticated, remote attacker to gain...

Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers Multicast DNS Denial of Service Vulnerability

A vulnerability in the multicast DNS mDNS feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper validation of mDNS packets. An attacker...

Cisco IOS and IOS XE Software Split DNS Denial of Service Vulnerability

A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service DoS condition. The vulnerability occurs because the regular expression regex engine that...

CVE-2020-3569

CVE-2020-3569 affects Cisco IOS XR Software DVMRP. The vulnerability stems from incorrect handling of IGMP packets, allowing an unauthenticated remote attacker to either immediately crash the IGMP process or exhaust memory, potentially destabilizing other processes (e.g., routing protocols). Expl...

Security Advisory - Insufficient Input Validation Vulnerability in Some Huawei Phones

There is an insufficient input validation vulnerability in some Huawei products. Due to the input validation logic is incorrect, an attacker can exploit this vulnerability to access and modify the memory of the device by doing a series of operations. Successful exploit may cause the service...

OPENSUSE-SU-2020:1505-1 Security update for libetpan

This update for libetpan fixes the following issues: Update to 1.9.4 boo1174579, CVE-2020-15953: Bugfixes on QUOTA Varios warning fixes & build fixes Update to version 1.9.3 Added IMAP CLIENTID / SMTP CLIENTID support Use Cyrus SASL 2.1.27 Update to version 1.9.2 Support of TLS SNI LMDB for cache...

PT-2020-20350 · Telestream · Telestream Tektronix Sentry +1

Name of the Vulnerable Software and Affected Versions: Telestream Tektronix Medius versions prior to 10.7.5 Telestream Tektronix Sentry versions prior to 10.7.5 Description: The issue allows an unauthenticated attacker to perform SQL injection, enabling them to dump database contents. This is...

OPENSUSE-SU-2020:1458-1 Security update for libjpeg-turbo

This update for libjpeg-turbo fixes the following issues: - CVE-2020-13790: Fixed a heap-based buffer over-read via a malformed PPM input file bsc1172491. This update was imported from the SUSE:SLE-15:Update update project...