12583 matches found
Cisco Firepower Threat Defense Software SSL Input Validation Denial of Service Vulnerability
A vulnerability in the sslinspection component of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to crash Snort instances. The vulnerability is due to insufficient input validation in the sslinspection component. An attacker could exploit this...
Multiple Cisco Products SNORT HTTP Detection Engine File Policy Bypass Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker...
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services File Upload Denial of Service Vulnerability
Update from October 22nd, 2020: Cisco has become aware of a new Cisco Adaptive Security Appliance vulnerability that could affect the fixed releases recommended for code trains 9.13 and 9.14 in the Fixed Software "fs" section of this advisory. See the Cisco Adaptive Security Appliance Software...
PT-2020-5183 · Cisco · Cisco Data Center Network Manager +1
Name of the Vulnerable Software and Affected Versions: Cisco Data Center Network Manager DCNM Software affected versions not specified Cisco Firepower Management Center FMC affected versions not specified Description: The issue is related to insufficient path restriction enforcement in a certain...
Vulnerability fixed in FreeType
A vulnerability has been fixed in FreeType. The vulnerability allows a remote malicious person to execute arbitrary code execute under the user's privileges. FreeType has released an update to fix the vulnerability. fix. More information can be found on the pages below:...
MGASA-2020-0388 Updated tigervnc packages fix a security vulnerability
In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception. CVE-2020-26117...
PT-2020-4500
Name of the Vulnerable Software and Affected Versions Java SE versions 7u271, 8u261, 11.0.8, and 15 Java SE Embedded version 8u261 Description The issue is related to insufficient input validation in the Libraries component of Java SE and Java SE Embedded, allowing a remote attacker to modify, ad...
OPENSUSE-SU-2020:1680-1 Security update for libproxy
This update for libproxy fixes the following issues: - CVE-2020-25219: Rewrote url::recvline to be nonrecursive bsc1176410. - CVE-2020-26154: Fixed a buffer overflow when PAC is enabled bsc1177143. This update was imported from the SUSE:SLE-15:Update update project...
CVE-2020-16938
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log on ...
OPENSUSE-SU-2020:1677-1 Security update for rubygem-activesupport-5_1
This update for rubygem-activesupport-51 fixes the following issues: - CVE-2020-8165: Fixed deserialization of untrusted data in MemCacheStore potentially resulting in remote code execution bsc1172186 This update was imported from the SUSE:SLE-15:Update update project...
CVE-2020-9862
A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web...
MGASA-2020-0385 Updated brotli packages fix security vulnerability
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB CVE-2020-8927...
PT-2020-20067 · Nextcloud +1 · Nextcloud Server +1
Name of the Vulnerable Software and Affected Versions: Nextcloud Server version 19.0.1 Description: The issue is related to insufficient protection of server-side encryption keys, allowing an attacker to replace these keys. Recommendations: For Nextcloud Server version 19.0.1, update to a version...
PT-2020-20000 · Nextcloud +1 · Nextcloud Server +1
Name of the Vulnerable Software and Affected Versions: Nextcloud Server version 18.0.4 Description: A too small set of random characters being used for encryption allowed decryption in a shorter time than intended. Recommendations: For Nextcloud Server version 18.0.4, update to a version that use...
PT-2020-4303
Name of the Vulnerable Software and Affected Versions: ARC Informatique PcVue versions prior to 12.0.17 Description: The issue is related to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server. This is due to...
Security Bulletin: NVIDIA GPU Display Driver - September 2020
NVIDIA has released a software security update for NVIDIA® GPU Display Driver. This update addresses issues that may lead to denial of service, code execution, escalation of privileges, or information disclosure. To protect your system, download and install this software update from the NVIDIA...
DLA-2404-1 eclipse-wtp - security update
Bulletin has no description...
Cisco Webex Teams Client for Windows DLL Hijacking Vulnerability
A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an authenticated, local attacker to load a malicious library. To exploit this vulnerability, the attacker needs valid credentials on the Windows system. The vulnerability is due to...
Cisco SD-WAN vManage Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly...