7222 matches found
Design/Logic Flaw
The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...
CVE-2020-5252
The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...
CVE-2020-5252
CVE-2020-5252 concerns the command-line Python package Safety. Reports describe a low-severity issue where two Python-related characteristics permit a malicious package to poison-pill or obfuscate other packages, allowing bypass of Safety’s detection routines. This is said to occur when Safety ru...
CVE-2020-5252 Malicious package may avoid detection in python auditing
The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...
Exploit for Improper Authentication in Microsoft
Identify Exchange Servers vulnerable to CVE-2020-0688 CVE-202...
SUSE-SU-2020:0722-1 Security update for nghttp2
This update for nghttp2 fixes the following issues: nghttp2 was update to version 1.40.0 bsc1166481 - lib: Add nghttp2checkauthority as public API - lib: Fix the bug that stream is closed with wrong error code - lib: Faster huffman encoding and decoding - build: Avoid filename collision of static...
Froxlor Denial of Service and Information Disclosure Vulnerability
Froxlor is a server administration control panel that can be used to manage multi-user or shared servers. A denial of service and information disclosure vulnerability exists in Froxlor versions prior to 0.10.14. The vulnerability stems from the fact that Froxlor creates files with static names in...
Updated mbedtls packages fix security vulnerabilities
Updated mbedtls packages fix security vulnerabilities: If Mbed TLS is running in an SGX enclave and the adversary has control of the main operating system, they can launch a side channel attack to recover the RSA private key when it is being imported. Found by Alejandro Cabrera Aldaya and Billy...
CVE-2020-10112
Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By default, Citrix ADC only caches static content served under certain URL paths for Citrix Gateway usage. No dynamic content is served under these paths, which implies that those cached...
PT-2020-11934 · Citrix · Citrix Adc +1
Name of the Vulnerable Software and Affected Versions: Citrix Gateway versions 11.1 through 12.1 Description: The issue allows Cache Poisoning. By default, Citrix ADC only caches static content served under certain URL paths for Citrix Gateway usage. No dynamic content is served under these paths...
CVE-2020-1731
A flaw was found in all versions of the Keycloak operator, before version 8.0.2,community only where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace...
Product release: Virtuozzo Infrastructure Platform 3.5 Update 1 (3.5.1-43)
This update provides a new feature as well as fixes and improvements. Vulnerability id: VSTOR-30003 Unable to release node from cluster: 'Unable to send message to any node in ABGW cluster'. Vulnerability id: VSTOR-30135 No read/write data on dashboards if multipath is configured. Vulnerability i...
[SECURITY] Fedora 31 Update: hugo-0.59.1-2.fc31~bootstrap
Hugo is a static HTML and CSS website generator written in Go. It is optimi zed for speed, easy use and configurability. Hugo takes a directory with content and templates and renders them into a full HTML website...
[SECURITY] Fedora 30 Update: hugo-0.55.6-2.fc30
Hugo is a static HTML and CSS website generator written in Go. It is optimi zed for speed, easy use and configurability. Hugo takes a directory with content and templates and renders them into a full HTML website...
New Research Paper: Prevalence and impact of low-entropy packing schemes in the malware ecosystem
Detection of malware is a constant battle between the technologies designed to detect and prevent malware and the authors creating them. One common technique adversaries leverage is packing binaries. Packing an executable is similar to applying compression or encryption and can inhibit the abilit...
CVE-2020-1731
A flaw was found in the Keycloak operator community only where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace. Mitigation No known mitigation yet...
Design/Logic Flaw
Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service verifies the client's...
CVE-2019-19741
Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service verifies the client's...
CVE-2019-19741
CVE-2019-19741 affects Electronic Arts Origin 10.5.55.33574. Local privilege escalation arises from arbitrary directory DACL manipulation via OriginClientService: Origin.exe connects to a named pipe, the privileged service validates the client’s executable (not its in-memory image), enabling DACL...
