PT-2020-14049 · Philips · Philips Clinical Collaboration Platform

Name of the Vulnerable Software and Affected Versions: Philips Clinical Collaboration Platform versions 12.2.1 and prior Description: The issue arises because the product does not properly validate input or data it receives, which can lead to incorrect processing. Recommendations: For versions...

Security Advisory - Use-after-free Vulnerability in Some Huawei Smart Phone

There is a use-after-free UAF vulnerability in some Huawei smart phone. An authenticated, local attacker may perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege and compromise the service. Vulnerability ID:...

DLA-2374-1 gnome-shell - security update

Bulletin has no description...

PT-2020-13794

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.57 Apache Tomcat versions 9.0.0.M1 through 9.0.37 Apache Tomcat versions 10.0.0-M1 through 10.0.0-M7 Description If an HTTP/2 client exceeds the agreed maximum number of concurrent streams for a...

OPENSUSE-SU-2020:1428-1 Security update for librepo

This update for librepo fixes the following issues: - Fixed path validation to prevent directory traversal attacks bsc1175475, CVE-2020-14352 This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project...

IBEXA-SA-2020-006 Object Injection in legacy shop module

More info at https://ezplatform.com/security-advisories/ibexa-sa-2020-006-object-injection-in-legacy-shop-module...

Vulnerability fixed in WebSphere Application Server Admin Console

IBM has fixed a vulnerability in the WebSphere Application Server Admin Console. The attack that can exploit this vulnerability exploit is referred to as Cross-Site Scripting. The vulnerability allows an unauthenticated remote malicious person is able to execute arbitrary code in the browser of t...

SUSE-SU-2020:2603-1 Security update for gimp

This update for gimp fixes the following issue: - CVE-2017-17789: Fix heap buffer overflow in PSP importer bsc1073627...

SUSE-SU-2020:2602-1 Security update for slurm

This update for slurm fixes the following issues: - Fix Authentication Bypass when Message Aggregation is enabled CVE-2020-12693 This fixes and issue where authentication could be bypassed via an alternate path or channel when message Aggregation was enabled. A race condition allowed a user to...

PT-2020-6207 · Ruby +3 · Ruby On Rails +3

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions prior to 5.2.4.4 and 6.0.3.3 Description: The issue is related to a potential Cross-Site Scripting XSS vulnerability in Action View's translation helpers. Views that allow the user to control the default value of the t...

Security Advisory - Information Leak Vulnerability in Huawei Smartphone

There is an information vulnerability in Huawei smartphones. A module has a design error that is lack of control of input. Attackers can exploit this vulnerability to obtain some information. This can lead to information leak. Vulnerability ID: HWPSIRT-2018-03100 This vulnerability has been...

Security Advisory - Buffer Overflow Vulnerability on Several Mobile Broadband Products

There is a buffer overflow vulnerability on several mobile broadband products. The software does not sufficiently validate the length of certain fields in DHCP message which is received. Successful exploit could cause the device to reboot. Vulnerability ID: HWPSIRT-2017-09083 This vulnerability h...

PT-2020-4027 · Microsoft · Office For Mac +1

Name of the Vulnerable Software and Affected Versions: Microsoft Office for Mac affected versions not specified Microsoft Office affected versions not specified Description: The issue is related to an information disclosure problem caused by reading out of bound memory due to an uninitialized...

PT-2020-4024 · Microsoft · Onedrive For Windows

Name of the Vulnerable Software and Affected Versions: OneDrive for Windows affected versions not specified Description: The issue is related to the improper handling of symbolic links by the OneDrive for Windows Desktop application. This could allow an attacker to overwrite a targeted file with ...

NVIDIA GeForce Experience - July 2020 - Lenovo Support US

Lenovo Security Advisory: LEN-43116 Potential Impact: Code execution, denial of service, privilege escalation Severity: Medium Scope of Impact: Industry-wide CVE Identifier: CVE‑2020‑5964 Summary Description: NVIDIA has released a software security update for NVIDIA GeForce Experience software...

DSA-4760-1 qemu - security update

Bulletin has no description...

Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directo...

Cisco Jabber for Windows Universal Naming Convention Link Handling Vulnerability

A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages that...

Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability

A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system...

Cisco IOS XR Authenticated User Privilege Escalation Vulnerability

A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to execute that command, even though administrative privileges should be required. The attacker must have valid credentials on the affected device. The...