12616 matches found
SUSE-SU-2020:0725-1 Security update for tomcat
This update for tomcat fixes the following issues: - CVE-2020-1938: Fixed a file contents disclosure vulnerability bsc1164692...
RUSTSEC-2020-0008 Flaw in hyper allows request smuggling by sending a body in GET requests
Vulnerable versions of hyper allow GET requests to have bodies, even if there is no Transfer-Encoding or Content-Length header. As per the HTTP 1.1 specification, such requests do not have bodies, so the body will be interpreted as a separate HTTP request. This allows an attacker who can control...
DLA-2148-1 amd64-microcode - security update
Bulletin has no description...
Security Advisory - Double Free Vulnerability in Some Huawei Products
There is a double free vulnerability in some Huawei products. A local attacker with low privilege may perform some operations to exploit the vulnerability. Due to doubly freeing memory, successful exploit may cause some service abnormal. Vulnerability ID: HWPSIRT-2019-09024 This vulnerability has...
[SECURITY] Fedora 31 Update: mediawiki-1.32.6-1.fc31
MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...
PT-2020-12055 · Wpforms · Wpforms Contact Form
Name of the Vulnerable Software and Affected Versions: WPForms Contact Form plugin versions prior to 1.5.9 Description: A stored cross-site scripting XSS issue exists in the WPForms Contact Form plugin for WordPress. This allows for malicious scripts to be stored and executed on the site...
Security Advisory - Information Leakage Vulnerability in Motion Sensor
Motion sensor in some Huawei smart phones has an information leakage vulnerability. An attacker may exploit this vulnerability to obtain specific information from the motion sensor through an APP installed on the smart phone and track the user. Successful exploit may cause information leak...
Security Advisory - Improper Authentication Vulnerability in Huawei Smartphone
There is an improper authentication vulnerability in some Huawei smartphone. Authentication to target component is improper when device performs an operation. Attackers exploit this vulnerability to obtain some information by loading malicious application, leading to information leak. Vulnerabili...
OPENSUSE-SU-2020:0332-1 Security update for gd
This update for gd fixes the following issues: Security issue fixed: - CVE-2018-14553: Fixed a null pointer dereference in gdImageClone bsc1165471. - CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm bsc1140120. This update was imported from the SUSE:SLE-15:Update update...
PT-2020-2443 · Siemens · Control Center Server +1
Name of the Vulnerable Software and Affected Versions: Control Center Server CCS versions prior to V1.5.0 SiNVR/SiVMS Video Server versions prior to V5.0.0 Description: A vulnerability has been identified where the FTP services of the SiVMS/SiNVR Video Server and the Control Center Server CCS...
CVE-2020-5256
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users...
HPSBHF03659 rev. 4 - Intel® Smart Sound Technology March 2020 Security Update
Potential Security Impact Escalation of Privilege Source: HP, HP Product Security Response Team PSRT Reported By: Intel VULNERABILITY SUMMARY Intel has informed HP of a security vulnerability in the Intel® Smart Sound Technology which may allow an authenticated user to potentially enable escalati...
OPENSUSE-SU-2020:0308-1 Security update for python-bleach
This update for python-bleach to version 3.1.1 fixes the following issue: - Python-bleach was updated to 3.1.1 - CVE-2020-6802: Fixed mutation XSS vulnerabilities boo1165303...
MGASA-2020-0123 Updated chromium-browser-stable packages fix security vulnerabilities
Chromium-browser 80.0.3987.122 fixes security issues: Multiple flaws were found in the way Chromium 79.0.3945.130 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information...
SUSE-SU-2020:0589-1 Security update for postgresql10
This update for postgresql10 fixes the following issues: PostgreSQL was updated to version 10.12. Security issue fixed: - CVE-2020-1720: Fixed a missing authorization check in the ALTER ... DEPENDS ON extension bsc1163985...
NCSC Releases Advisory on Securing Internet-Connected Cameras
The United Kingdom UK National Cyber Security Centre NCSC has released an advisory on securing internet-connected cameras such as smart security cameras and baby monitors. An attacker could gain access to unsecured, or poorly secured, internet-connected cameras to obtain live feeds or images. The...
Cisco Remote PHY Device Software Command Injection Vulnerability
A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exists because the affected software does not properly sanitize user-supplied input. An...
Cisco IOS XR Software IPsec Packet Processor Denial of Service Vulnerability
A vulnerability in the IPsec packet processor of Cisco IOS XR Software could allow an unauthenticated remote attacker to cause a denial of service DoS condition for IPsec sessions to an affected device. The vulnerability is due to improper handling of packets by the IPsec packet processor. An...
Cisco Prime Network Registrar Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based interface of Cisco Prime Network Registrar CPNR could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections in the web-based interface. An...