The vulnerability of Google Chrome browsers, related to the use after release, allows a violator to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of Google Chrome relates to its use after release. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to information through a specially created HTML page...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM LKS Administration & Reporting Tool and Agent

Summary Mutiple security vulnerabilities have been found in IBM Java Runtime used by IBM LKS Administration & Reporting Tool ART and Agent. A mitigation has been included in the latest release. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...

The vulnerability of the Grafana data representation web tool, related to authentication errors, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Grafana data presentation web tool is related to authentication errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the process_http_response function in applications for connecting to OpenConnect virtual private networks allows a perpetrator to gain unauthorized access to information and compromise its integrity and availability.

The vulnerability of the processhttpresponse function in applications for connecting to OpenConnect virtual private networks is related to buffer overflow vulnerabilities. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to information and...

Vulnerability of the tcpdump.c.get_next_file() function: This function is used by the tcpdump tool for analyzing network traffic. An attacker can exploit this vulnerability to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of the tcpdump.c.getnextfile function, a tool for analyzing network traffic, is related to buffer overflow vulnerabilities. Exploiting this vulnerability could allow an attacker to gain unauthorized access to information and compromise its integrity and availability...

UBUNTU-CVE-2020-1730

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR or DES ciphers if enabled ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The bigges...

Samsung Mobile Device Input Validation Error Vulnerability (CNVD-2020-30598)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from an input validation error vulnerability that can be exploited by attackers to compromise availability, confidentiality, and...

CVE-2019-3004

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks...

kernel: buffer-overflow hardening in WiFi beacon validation code.

A flaw in the Linux kernel's WiFi beacon validation code was discovered. The code does not check the length of the variable length elements in the beacon head potentially leading to a buffer overflow. System availability, as well as data confidentiality and integrity, can be impacted by this...

CVE-2020-5292

Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and...

CVE-2017-3461

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows high privileged attacker with network access vi...

Security Bulletin: API Connect is impacted by multiple vulnerabilities in Oracle MySQL.

Summary IBM API Connect had addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-2791 DESCRIPTION: An unspecified vulnerability in Oracle MySQL related to the Server Server: Audit Plug-in component could allow an authenticated attacker to cause low confidentiality impact...

HTTP/2: flood using HEADERS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using SETTINGS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using SETTINGS frames and queuing of SETTINGS ACK frames, a flood could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Message Broker and IBM Integration Bus

Summary Multiple security vulnerabilities exist in IBM® Runtime Environment Java™ Technology Edition 6.0.16.30 and earlier used by WebSphere Message Broker, and IBM® Runtime Environment Java™ Technology Edition 7.0.9.50 and earlier used by WebSphere Message Broker and IBM Integration Bus, and the...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/TPF

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2604 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker to take...

HTTP/2: 0-length headers lead to denial of service

A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially...

HTTP/2: request for large response leads to denial of service

A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server's...

HTTP/2: large amount of data requests leads to denial of service

A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a...