CVE-2021-33879

Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only...

CVE-2021-33879

Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only...

Design/Logic Flaw

Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only...

CVE-2021-33879

Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only...

CVE-2021-20988 Hilscher rcX RTOS: Wrong handling of the UDP checksum

In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. This may lead to a denial of service of the affected device...

SUSE: Security Advisory (SUSE-SU-2016:0173-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Homebrew: Brew bootstrap process is insecure

The process described in this page is not secure - no checksum / PGP signature is published and there is no way to check the download is legit: https://brew.sh/ "/bin/bash -c "$curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh"" This can lead to supply chain attacks su...

openSUSE: Security Advisory for virtualbox (openSUSE-SU-2021:0165-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

FAQ: Configuring Local Access Using Receiver for HTML5 1.0

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. This article contains Frequently Asked Questions on configuring local access using Citrix Receiver f...

The vulnerability of the uIP TCP/IP Stack component of the Contiki OS allows a hacker to trigger a service failure.

The vulnerability of the upperlayerchksum function in the net/ipv4 /uip.c part of the uIP TCP/IP Stack of the Contiki OS framework is related to the reading of data beyond the specified buffer. Exploiting this vulnerability could allow a malicious actor to cause service failure remotely...

[SECURITY] Fedora 33 Update: pngcheck-2.4.0-7.fc33

pngcheck verifies the integrity of PNG, JNG and MNG files by checking the internal 32-bit CRCs checksums and decompressing the image data; it can optionally dump almost all of the chunk-level information in the image in human-readable form. For example, it can be used to print the basic statist i...

The vulnerability of D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500, DSR-500N, DSR-500AC, DSR-1000, DSR-1000N, and DSR-1000AC router microprogramming systems lies in the deficiencies in the algorithm for calculating the checksum. This vulnerability allows attackers to exploit their privileges and execute arbitrary code.

The vulnerability of the software for monitoring the performance of SolarWinds Database Performance Analyzer is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute a cross-site scripting attack remotely...

CVE-2018-1000891

CVE-2018-1000891 affects Bitcoin SV before 0.1.1, where receiving messages with invalid checksums can cause uncontrolled resource consumption (DoS). Root cause: improper handling of invalid checksum messages leading to resource exhaustion. Impact: high (availability impact) per CVSSv3.1, base 7.5...

CVE-2020-26277

DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a syst...

CVE-2020-26277 Arbitrary read/write in DBdeployer

DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a syst...

PT-2020-16399 · Mysql Server · Dbdeployer

Name of the Vulnerable Software and Affected Versions: DBdeployer versions prior to 1.58.2 Description: DBdeployer is a tool that deploys MySQL database servers easily. Users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such...

RHEL 7 : java-1.8.0-ibm (RHSA-2020:5585)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5585 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...

D-Link DSR-250 Command Injection Vulnerability (CNVD-2020-72722)

The D-Link DSR-250 is an 8-port Gigabit VPN router with dynamic Web content filtering. A command injection vulnerability exists in the D-Link DSR-250 3.17. The vulnerability stems from insufficient validation of configuration file checksums. An attacker can use this vulnerability to inject...

Multiple Huawei products licensing issues vulnerabilities

Huawei CloudEngine 12800 and others are products of Huawei, China.Huawei CloudEngine 12800 is a 12800 series data center switch.Huawei Cloudengine 5800 is a 5800 series data center switch.Huawei Cloudengine 6800 is a 6800 series data center switch. A security vulnerability exists in certain Huawe...

CVE-2020-25758

An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authenticated attacker to inject arbitrary crontab entries into saved configurations before uploading. These entries are executed as root...