8403 matches found
Dive Deep into VMDR
Qualys devoted the second day of the QSC USA 2020 virtual conference entirely to vulnerability management, detection and response VMDR, a critical area for the security and compliance of hybrid cloud IT environments. Mehul Revankar, VP of Product Management and Engineering for VMDR at Qualys, set...
PT-2020-16802 · Linux +5 · Linux Kernel +5
Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A flaw was found in the JFS filesystem code, allowing a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating...
CVE-2020-8695
A vulnerability was found in Intel's implementation of RAPL Running Average Power Limit. An attacker with a local account could query the power management functionality to intelligently infer SGX enclave computation values by measuring power usage in the RAPL subsystem. Mitigation Until a firmwar...
Denial Of Service (DoS)
github.com/brocaar/chirpstack-network-server is vulnerable to denial of service DoS. Mishandling of de-duplication at the MQTT backend allows an attacker to cause a denial of service condition by sending malicious frequency attributes to CollectAndCallOnceCollect in internal/uplink/collect.go...
Servicing stack update for Windows 10, version 2004 and 20H2: November 10, 2020
None None...
CVE-2020-28349
An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequency attributes in CollectAndCallOnceCollect in internal/uplink/collect.go. NOTE: the vendor's position is that there are no "guarantees...
Design/Logic Flaw
An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequency attributes in CollectAndCallOnceCollect in internal/uplink/collect.go. NOTE: the vendor's position is that there are no "guarantees...
PT-2020-16991 · Chirpstack · Chirpstack Network Server
Name of the Vulnerable Software and Affected Versions: ChirpStack Network Server version 3.9.0 Description: The issue is related to an inaccurate frame deduplication process, allowing a malicious gateway to perform an uplink Denial of Service via malformed frequency attributes in the...
tcpdump: Resource exhaustion in bgp_attr_print() function in print-bgp.c
An uncontrolled resource consumption flaw was discovered in the way tcpdump prints BGP packets. The BGP protocol allows ATTRSET to be nested as many times as the message can accommodate, however when a specially crafted packet is crafted and parsed by tcpdump, this may lead to stack exhaustion du...
Prototype Pollution
ts-dot-prop is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
Prototype Pollution
nested-property is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
CVE-2020-27890
The Zigbee protocol implementation on Texas Instruments CC2538 devices with Z-Stack 3.0.1 does not properly process a ZCL Write Attributes No Response message. It crashes in zclParseInWriteCmd and does not update the specific attribute's value...
CVE-2020-27890
The Zigbee protocol implementation on Texas Instruments CC2538 devices with Z-Stack 3.0.1 does not properly process a ZCL Write Attributes No Response message. It crashes in zclParseInWriteCmd and does not update the specific attribute's value...
Prototype Pollution
pathval is vulnerable to prototype pollution. The function parsePath allows an attacker to get control of value of “path” and modify attributes such as proto, constructor and prototype...
kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt
A flaw was found in the Linux kernel. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leadi...
[SECURITY] Fedora 33 Update: python-bleach-3.2.1-1.fc33
Bleach is an HTML sanitizing library that escapes or strips markup and attributes based on a white list...
Exploit for Prototype Pollution in Apache Struts
It is an offensive tool for Apache Struts 2 exploitation. The re...
Remote Code Execution (RCE)
openmage/magento-lts is vulnerable to remote code execution RCE. The vulnerability exists as an admin user can generate SOAP credentials that can be used to cause RCE with a PHP Object Injection flaw through the product attributes...
CVE-2020-15244
In Magento rubygems openmage/magento-lts package before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4...
kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt
A flaw was found in the Linux kernel. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leadi...