org.eclipse.jetty.aggregate:jetty-all (11.0.0.beta1), org.eclipse.jetty.demos:demo-async-rest-server (11.0.0.beta2) +21 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (>=11.0.0.beta1, <=11.0.0.beta2)

org.eclipse.jetty:jetty-webapp MAVEN version =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta2 and more Source cves: CVE-2020-27216 Source advisory: GHSA-G3WG-6MCF-8JJ6...

GHSA-8HXH-R6F7-JF45 Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

org.scala-steward:scala-steward-core_2.13 (>=0.6.0, <=0.7.0) potentially affected by CVE-2020-11612 via org.http4s:http4s-async-http-client_2.13 (>=0.21.4, <=0.21.7)

org.http4s:http4s-async-http-client2.13 MAVEN version =0.21.4, =0.6.0, =0.7.0 Source cves: CVE-2020-11612 Source advisory: GHSA-8HXH-R6F7-JF45...

org.scala-steward:scala-steward-core_2.13 (>=0.6.0, <=0.7.0) potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.13 (>=0.21.4, <=0.21.7)

org.http4s:http4s-async-http-client2.13 MAVEN version =0.21.4, =0.6.0, =0.7.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

edu.gemini:gsp-core-ephemeris_2.12 (>=0.1.3, <=0.1.7), edu.gemini:gsp-core-ocs2_2.12 (>=0.1.3, <=0.1.7) +1 more potentially affected by CVE-2020-11612 via org.http4s:http4s-async-http-client_2.12 (>=0.21.0-m6, <=0.21.1)

org.http4s:http4s-async-http-client2.12 MAVEN version =0.21.0-m6, =0.1.3, =0.1.3, =0.1.7 - org.scala-steward:scala-steward-core2.12 0.5.0 Source cves: CVE-2020-11612 Source advisory: GHSA-8HXH-R6F7-JF45...

edu.gemini:gsp-core-ephemeris_2.12 (>=0.1.3, <=0.1.7), edu.gemini:gsp-core-ocs2_2.12 (>=0.1.3, <=0.1.7) +1 more potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.12 (>=0.21.0-m6, <=0.21.1)

org.http4s:http4s-async-http-client2.12 MAVEN version =0.21.0-m6, =0.1.3, =0.1.3, =0.1.7 - org.scala-steward:scala-steward-core2.12 0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

Unbreakable Enterprise kernel security update

4.1.12-124.42.3 - can: peakusb: pcanusbfd: Fix info-leaks to USB devices Tomas Bortoli Orabug: 31351221 CVE-2019-19535 - media: hdpvr: Fix an error handling path in hdpvrprobe Arvind Yadav Orabug: 31352053 CVE-2017-16644 - fs/binfmtmisc.c: do not allow offset overflow Thadeu Lima de Souza Cascard...

Sandbox Breakout / Arbitrary Code Execution in value-censorship

All versions of value-censorship are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code. Recommendation No fix is currently available. Consider using an alternative package until a f...

PT-2020-21596

Name of the Vulnerable Software and Affected Versions value-censorship versions affected versions not specified Description The issue concerns the failure to validate async function constructors, allowing attackers to execute arbitrary code, which can lead to Remote Code Execution. Recommendation...

SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2020:2069-1)

This update for webkit2gtk3 fixes the following issues : Update to version 2.28.3 bsc1173998 : + Enable kinetic scrolling with async scrolling. + Fix web process hangs on large GitHub pages. + Bubblewrap sandbox should not attempt to bind empty paths. + Fix threading issues in the media player. +...

Security update for webkit2gtk3 (important)

openSUSE Security Update: Security update for webkit2gtk3 Announcement ID: openSUSE-SU-2020:1064-1 Rating: important References: 1173998 Cross-References: CVE-2020-13753 CVE-2020-9802 CVE-2020-9803 CVE-2020-9805 CVE-2020-9806 CVE-2020-9807 CVE-2020-9843 CVE-2020-9850 Affected Products: openSUSE...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2020:1992-1)

This update for webkit2gtk3 fixes the following issues : Update to version 2.28.3 bsc1173998 : + Enable kinetic scrolling with async scrolling. + Fix web process hangs on large GitHub pages. + Bubblewrap sandbox should not attempt to bind empty paths. + Fix threading issues in the media player. +...

Telerik UI RadAsyncUpload Arbitrary File Upload Code Execution

The vulnerability of the Telerik UI software for ASP.NET AJAX is related to the shortcomings of the RadAsyncUpload encryption mechanism. Exploiting this vulnerability allows a malicious actor to perform arbitrary file uploads or execute arbitrary code...

Clipboardme - Grab And Inject Clipboard Content By Link

Grab/Inject Clipboard Content Browsers are implementing a new JavaScript API for asynchronous clipboard access to integrate copy and paste into web applications. It is a replacement for the synchronous execCommand-based copy & paste. Async Clipboard requests doesn't block the page while waiting t...

Exploit for Injection in Oracle Agile_Plm

CVE-2019-2725 CVE-2019-2725CNVD-C-2019-48814、WebLogic wls9-async 命令回显 10.3.6 12.1.3 ResultBaseExec.java 用于测试defineClass，将把恶意类从base64还原出来，执行代码，主要是比较方便（可用可不用）。 JDK7u21.java 会生成weblogic-2019-272512.1.3命令执行.txt中的xml，请使用jdk6编译。 CVE-2019-2725.py 检测命令是否会执行。...

OPENSUSE-SU-2020:0357-1 Security update for salt

This update for salt fixes the following issues: - Avoid possible user escalation upgrading salt-master bsc1157465 CVE-2019-18897 - Fix unit tests failures in testbatchasync tests - Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU...

SUSE-SU-2020:0684-1 Security update for salt

This update for salt fixes the following issues: - Avoid possible user escalation upgrading salt-master bsc1157465 CVE-2019-18897 - Fix unit tests failures in testbatchasync tests - Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU...

VulnCheck KEV: CVE-2020-36854

The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the ajsteps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it...

be.wegenenverkeer:atomium-client-akka_2.10 (0.7.0), be.wegenenverkeer:atomium-client-akka_2.11 (0.7.0) +82 more potentially affected by CVE-2019-20445 via io.netty:netty (3.9.5.final)

io.netty:netty MAVEN version 3.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - be.wegenenverkeer:atomium-client-akka2.10 0.7.0 - be.wegenenverkeer:atomium-client-akka2.11 0.7.0 -...