rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

The --preserve-root check uses a path-string test path.hasroot && path.parent.isnone rather than comparing device/inode. A symlink to / e.g. /tmp/rootlink - / has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it...

EUVD-2020-28094

Malware in sbrugna...

CVE-2020-6954

An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Connection String Test. This password is shown in the webpass parameter of a mediafolder.cgi?applymode=pingserver URI...

CVE-2020-7661

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service...

CVE-2020-7661

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service...

PT-2020-3969 · Url-Regex · Url-Regex

Name of the Vulnerable Software and Affected Versions: url-regex versions prior to a fixed version Description: The issue is related to a Regular Expression Denial of Service in the url-regex package. An attacker can cause a Denial of Service by providing a very long string in String.test. This c...