EulerOS 2.0 SP3 : numpy (EulerOS-SA-2020-2083)

According to the version of the numpy packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary...

EulerOS 2.0 SP3 : perl-XML-LibXML (EulerOS-SA-2020-2055)

According to the version of the perl-XML-LibXML package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the...

EulerOS 2.0 SP3 : openssh (EulerOS-SA-2020-2112)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious...

Security Bulletin: Publicly disclosed vulnerability from Kernel affects IBM Netezza Host Management

Summary Kernel is used by IBM Netezza Host Management. This bulletin provides mitigation for the reported CVE. Vulnerability Details CVEID: CVE-2020-14416 DESCRIPTION: Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a race condition in tty-discdata...

Security Bulletin: Publicly disclosed vulnerabilities from Kernel affect IBM Netezza Host Management

Summary Kernel is used by IBM Netezza Host Management. This bulletin provides mitigation for the reported CVEs Vulnerability Details CVEID: CVE-2020-12655 DESCRIPTION: Linux Kernel could allow a local attacker to bypass security restrictions, caused by a flaw in the xfsagfverify function in...

Xen Cross-Site Scripting Vulnerability

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in Xen versi...

Activision Refutes Claims of 500K-Account Hack

After reports surfaced that 500,000 Activision accounts may have been hacked, impacting online Call of Duty CoD players, the gaming giant is disputing the claim. The alleged breach was first flagged by the oRemyy account on Twitter, and was quickly amplified by others, who claimed that accounts...

The vulnerability of the executable file splwow64.exe on Microsoft Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the executable file splwow64.exe in Microsoft Windows operating systems is related to errors in call handling. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the splwow64.exe process in the Windows operating system, which allows a hacker to escalate their privileges

The vulnerability of the splwow64.exe process in Windows operating systems is related to call processing errors. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the Win32k.sys component of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Win32k.sys component of the Windows operating system is related to errors in call handling. Exploiting this vulnerability can allow an attacker to enhance their privileges by running a specially created application...

USN-4503-1 libdbi-perl vulnerability

It was discovered that Perl DBI module incorrectly handled certain calls. An attacker could possibly use this issue to execute arbitrary code...

FreeBSD-SA-20:30.ftpd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:30.ftpd Security Advisory The FreeBSD Project Topic: ftpd privilege escalation via ftpchroot feature Category: core Module: ftpd Announced: 2020-09-15...

McAfee Agent Elevation of Privilege Vulnerability

McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator antivirus management platform and managed products. An elevation of privilege vulnerability exists in McAfee Agent. The vulnerability stems from an incorrect programmat...

Command Injection in entitlements

Versions of entitlements prior to 1.3.0 are vulnerable to Command Injection. The package does not validate input on the entitlements function and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation Upgrade to version 1.3.0 or later...

GHSA-WGW3-GF4P-62XC Command Injection in wizard-syncronizer

All versions of wizard-syncronizer are vulnerable to Command Injection. The package does not validate input on the cloneAndSync function and concatenates it to an exec call. This can be abused through a malicious widget containing the payload in the gitURL value or through a MITM attack since the...

Command Injection in wxchangba

All versions of wxchangba are vulnerable to Command Injection. The package does not validate user input on the reqPostMaterial function, passing contents of the file parameter to an exec call. This may allow attackers to run arbitrary commands in the system. Recommendation No fix is currently...

GHSA-J6V9-XGVH-F796 Command Injection in wxchangba

All versions of wxchangba are vulnerable to Command Injection. The package does not validate user input on the reqPostMaterial function, passing contents of the file parameter to an exec call. This may allow attackers to run arbitrary commands in the system. Recommendation No fix is currently...

GHSA-8MGG-5X65-M4M4 Command Injection in soletta-dev-app

All versions of soletta-dev-app are vulnerable to Command Injection. The package does not validate user input on the /api/service/status API endpoint, passing contents of the service query parameter to an exec call. This may allow attackers to run arbitrary commands in the system. Recommendation ...

Command Injection in soletta-dev-app

All versions of soletta-dev-app are vulnerable to Command Injection. The package does not validate user input on the /api/service/status API endpoint, passing contents of the service query parameter to an exec call. This may allow attackers to run arbitrary commands in the system. Recommendation ...

CDRThief malware targets Linux VoIP softwitches to steal call records

By Deeba Ahmed ESET researchers have identified a new malware called CDRThief strain targeting a specific VoIP platform that two Chinese softswitches use. This is a post from HackRead.com Read the original post: CDRThief malware targets Linux VoIP softwitches to steal call records...