JVN#90729322: Hibernate ORM vulnerable to SQL injection

Hibernate ORM is an ORM framework for Java. Hibernate ORM can be configured hibernate.usesqlcomments to true, which is false by default to add comments to generated SQL statements, aimed at debugging purpose. When hibernate.usesqlcomments is configured to true, malicious input may produce...

Cisco IoT Field Network REST API Insufficient Input Validation Vulnerability

A vulnerability in the REST API of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. ...

Cisco Secure Web Appliance Privilege Escalation Vulnerability

A vulnerability in the log subscription subsystem of Cisco AsyncOS for the Cisco Secure Web Appliance formerly Web Security Appliance could allow an authenticated, local attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of...

DSA-4793-1 firefox-esr - security update

Bulletin has no description...

About the security content of macOS Big Sur 11.0.1

About the security content of macOS Big Sur 11.0.1 This document describes the security content of macOS Big Sur 11.0.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

Cisco IOS XE Software PROFINET Link Layer Discovery Protocol DoS (cisco-sa-ios-profinet-dos-65qYG3W5)

According to its self-reported version and configuration, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the PROFINET handler for Link Layer Discovery Protocol LLDP messages. An unauthenticated, adjacent attacker can exploit thisby sendi...

OPENSUSE-SU-2020:1929-1 Security update for chromium

This update for chromium fixes the following issues: Update to 86.0.4240.198 boo1178703 - CVE-2020-16013: Inappropriate implementation in V8 - CVE-2020-16017: Use after free in site isolation Update to 86.0.4240.193 boo1178630 - CVE-2020-16016: Inappropriate implementation in base...

OPENSUSE-SU-2020:1922-1 Security update for python-waitress

This update for python-waitress to 1.4.3 fixes the following security issues: - CVE-2019-16785: HTTP request smuggling through LF vs CRLF handling bsc1161088. - CVE-2019-16786: HTTP request smuggling through invalid Transfer-Encoding bsc1161089. - CVE-2019-16789: HTTP request smuggling through...

MGASA-2020-0413 Updated chromium-browser-stable packages fix security vulnerabilities

The chromium-browser-stable package has been updated to 86.0.4240.198 version that fixes multiples security vulnerabilities. From 81.0.4044.138 released on May 9th, 2020 to 86.0.4240.198 version, see upstream advisories...

MGASA-2020-0414 Updated lilypond package fixes a security vulnerability

It was discovered that Lilypond, a program for typesetting sheet music, did not restrict the inclusion of Postscript and SVG commands when operating in safe mode, which could result in the execution of arbitrary code when rendering a typesheet file with embedded Postscript code. CVE-2020-17353...

New ModPipe Point of Sale (POS) Malware Targeting Restaurants, Hotels

Cybersecurity researchers today disclosed a new kind of modular backdoor that targets point-of-sale POS restaurant management software from Oracle in an attempt to pilfer sensitive payment information stored in the devices. The backdoor — dubbed "ModPipe" — impacts Oracle MICROS Restaurant...

JVN#44764844: MELSEC iQ-R Series CPU Modules vulnerable to uncontrolled resource consumption

MELSEC iQ-R series CPU modules provided by Mitsubishi Electric Corporation contain an uncontrolled resource consumption vulnerability CWE-400. According to the developer, in case of "To Use or Not to Use Web Server Settings" in the parameter of CPU modules are set to "Not Use", this issue does no...

PT-2020-11855 · Apple · Macos High Sierra +5

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.2 iPadOS versions prior to 14.2 macOS Catalina versions prior to 10.15.7 macOS High Sierra versions prior to Security Update 2020-005 macOS Mojave versions prior to Security Update 2020-005 Description: An out-of-boun...

Vulnerability fixed in Adobe Reader Mobile

A vulnerability has been fixed in Adobe Reader Mobile for Android. A malicious party could exploit the vulnerability to gain access to sensitive data in the context of the victim. Adobe has released updates to fix the vulnerability in Reader Mobile 20.9.0. For more information, see:...

DLA-2448-1 firefox-esr - security update

Bulletin has no description...

Security Advisory - Denial of Service Vulnerability in Some Huawei Products

There is a denial of service vulnerability in some Huawei products. There is no protection against the attack scenario of specific protocol. A remote, unauthorized attacker can construct attack scenarios, which lead to denial of service. Vulnerability ID: HWPSIRT-2020-79490 This vulnerability has...

Cisco IOS XR Software Slow Path Forwarding Denial of Service Vulnerability

A vulnerability in the egress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers and Cisco Network Convergence System NCS 5000 Series Routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an...

PT-2020-5824 · Schneider Electric · Ecostruxure Building Operation Webreports

Name of the Vulnerable Software and Affected Versions: EcoStruxure Building Operation WebReports versions 1.9 through 3.1 Description: A CWE-284 Improper Access Control issue exists that could allow a remote attacker to access restricted web resources due to improper access control, potentially...

Security Bulletin: NVIDIA GeForce NOW - November 2020

NVIDIA has released a software update for NVIDIA® GeForce NOW™ application software on Windows. This update addresses a security issue that may lead to code execution or escalation of privileges. To protect your system, open the GeForce NOW application to automatically download the update and...

Intel® 50GbE IP Core for Intel® Quartus Prime Advisory

This advisory contains CVEs in Altera products and has been transferred to Altera for support. The updated advisory can be found at the link below: https://www.altera.com/product-security/advisory-archive/intel-sa-00400.html...