Denial Of Service (DoS)

dovecot is vulnerable to denial of service. A denial of service flaw was found in the way Dovecot handled NULL characters in certain header names. A mail message with specially-crafted headers could cause the Dovecot child process handling the target user's connection to crash, blocking them from...

Privilege Escalation

ruby is vulnerable to privilege escalation. It was found that WEBrick the Ruby HTTP server toolkit did not filter terminal escape sequences from its log files. A remote attacker could use specially-crafted HTTP requests to inject terminal escape sequences into the WEBrick log files. If a victim...

Spoofing Attack

php is vulnerable to spoofing attacks. It was discovered that PHP was affected by the previously published "null prefix attack", caused by incorrect handling of NUL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate...

Spoofing Attack

firefox is vulnerable to spoofing attacks. A flaw was found in the way Firefox displays certain Unicode characters. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site...

Man-in-the-Middle (MitM)

curl is vulnerable to man-in-the-middle attack. A null prefix attack caused by incorrect handling of NULL characters in X.509 certificates allows an attacker obtain a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a...

Arbitrary Code Execution

perl is vulnerable to arbitrary code execution. The vulnerability exists as a flaw was found in Perl's regular expression engine. A specially crafted regular expression with Unicode characters could trigger a buffer overflow, causing Perl to crash, or possibly execute arbitrary code with the...

Arbitrary Command Execution

php is vulnerable to arbitrary command execution. The vulnerability exists as it was discovered that the PHP escapeshellcmd function did not properly escape multi-byte characters which are not valid in the locale used by the script. This could allow an attacker to bypass quoting restrictions...

python security update

CentOS Errata and Security Advisory CESA-2020:1091 An update for python-twisted-web is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detaile...

CVE-2020-4282

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow an authenticated user to perform unauthorized actions by bypassing illegal character restrictions. X-Force ID: 176205...

Security Bulletin: Insufficient command validation in IBM Security Information Queue (CVE-2020-4282)

Summary IBM Security Information Queue ISIQ does not implement encoding or escaping of command requests that originate in the web UI. For example, it would be possible to intercept a product configuration request, and replace the product name with illegal characters. As of v1.0.6, ISIQ performs...

AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow (SEH)

Exploit Title: AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow SEH Date: 2020-04-02 Exploit Author: Hodorsec Version: v6.20.5300 Software Link: http://download.aida64.com/aida64engineer620.exe Vendor Homepage: https://www.aida64.com/products/aida64-engineer Tested on: Win7 x86...

Apache -- Multiple vulnerabilities

Apache Team reports: SECURITY: CVE-2020-1934 modproxyftp: Use of uninitialized value with malicious backend FTP server. SECURITY: CVE-2020-1927 rewrite, core: Set PCREDOTALL flag by default to avoid unpredictable matches and substitutions with encoded line break characters. The fix for...

RHEL 7 : python-twisted-web (RHSA-2020:1091)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1091 advisory. Twisted is an event-based framework for internet applications. Twisted Web is a complete web server, aimed at hosting web applications using Twisted...

10Strike LANState 9.32 - (Force Check) Buffer Overflow (SEH) Exploit

Exploit Title: 10Strike LANState 9.32 - 'Force Check' Buffer Overflow SEH Exploit Author: Hodorsec Version: v9.32 x86 Software Link: https://www.10-strike.com/lanstate/lanstate-setup.exe Vendor Homepage: https://www.freecommander.com Tested on: Win7 x86 SP1 - Build 7601 Description: - Exploits th...

Moderate: Red Hat Security Advisory: python-twisted-web security update

An update for python-twisted-web is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

openSUSE Security Update : python-mysql-connector-python (openSUSE-2020-409)

This update for python-mysql-connector-python fixes the following issues : python-mysql-connector-python was updated to 8.0.19 boo1122204 - CVE-2019-2435 : - WL13531: Remove xplugin namespace - WL13372: DNS SRV support - WL12738: Specify TLS ciphers to be used by a client or session - BUG30270760...

Denial Of Service (DoS)

github.com/buger/jsonparser is vulnerable to denial of service. A call to function Delete may cause infinite loop due to inadequate validation for special characters...

Cross-site Scripting (XSS)

actionview is vulnerable to cross-site scripting XSS. Inadequate sanitization and escaping of special characters such as dollar signs and backticks allows an attacker to inject and execute arbitrary Javascript in a user's browser via the j or javascriptescape helper...

[SECURITY] Fedora 31 Update: nethack-3.6.6-1.fc31

NetHack is a single player dungeon exploration game that runs on a wide variety of computer systems, with a variety of graphical and text interfaces all using the same game engine. Unlike many other Dungeons & Dragons-inspired games, the emphasis in NetHack is on discovering the detail of the...

Convincing Google Impersonation Opens Door to MiTM, Phishing

An attack that uses homographic characters to impersonate domain names and launch convincing but malicious websites takes minutes and a bare modicum of skill — while reaping high rates of success in luring victims, according to an independent researcher. Researcher Avi Lumelsky set out to see how...