UBUNTU-CVE-2020-27759

In IntensityCompare of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the range of type int to be returned. The flaw could be triggered by a crafted input file under certain conditions when processed by ImageMagick. Red Hat...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition in IBM Watson Compare and Comply for IBM Cloud Pak for Data

Summary Java SE issues disclosed in the Oracle July 2020 Critical Patch Update plus CVE-2019-17639. Vulnerability Details CVEID: CVE-2020-14583 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause low...

CVE-2020-6366

SAP NetWeaver Compare Systems versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service...

CVE-2020-6366

SAP NetWeaver Compare Systems versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service...

CVE-2020-6366

SAP NetWeaver Compare Systems versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service...

CVE-2020-6366

CVE-2020-6366 affects SAP NetWeaver (Compare Systems) versions 7.20, 7.30, 7.40, and 7.50 where uploaded XML documents are not sufficiently validated. The underlying issue enables an administrative attacker to retrieve arbitrary server files (including OS-level files) and can cause a denial-of-se...

CVE-2020-6366: Improper Input Validation

SAP NetWeaver Compare Systems versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service...

PT-2020-19139

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Compare Systems versions 7.20, 7.30, 7.40, 7.50 Description The issue concerns insufficient validation of uploaded XML documents, allowing an attacker with administrative privileges to retrieve arbitrary files, including those on...

compare-processors.com Cross Site Scripting vulnerability OBB-1386522

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

In the GNU C Library (aka glibc or libc6) through 2.29 the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.

...

Security Bulletin: CVE-2019-2949 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2019-2949 was disclosed in the Oracle October 2019 Critical Patch Update Vulnerability Details CVEID: CVE-2019-2949 DESCRIPTION: An unspecified vulnerability in Java SE related to the Kerberos component could allow an unauthenticated attacker to obtain sensitive information resulting ...

OSV-2020-1054 Heap-buffer-overflow in wabt::string_view::compare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18962 Crash type: Heap-buffer-overflow READ 6 Crash state: wabt::stringview::compare wabt::operator== wabt::BinaryReader::ReadCustomSection...

OSV-2020-846 Heap-buffer-overflow in std::__1::char_traits<char>::compare

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22358 Crash type: Heap-buffer-overflow READ 6 Crash state: std::1::chartraits::compare wabt::stringview::compare wabt::operator==...

PT-2020-22411

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow WRITE 3 crash type was identified, related to a fuzzer test. The crash state is associated with the collator compare fuzzer.cpp file...

PT-2020-22179

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, which was identified through an OSS-Fuzz report. The crash state involves several functions, including...

Security Bulletin: WebSphere Application Server Liberty is vulnerable to Cross-site Scripting (CVE-2020-4303, CVE-2020-4304)

Summary There is a cross-site scripting vulnerability in the OAuth, OpenID Connect and SAML features. This has been addressed. Vulnerability Details CVEID: CVE-2020-4303 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This...

Security Bulletin: CVE-2020-2654 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2020-2654 was disclosed as part of the Oracle January 2020 Critical Patch Update. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to cause a denial of...

Security Bulletin: Vulnerability in Apache CXF affects WebSphere Application Server (CVE-2019-12406)

Summary There is a denial of service in the Apache CXF library used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2019-12406 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by the failure to restrict the number of message attachmen...

Security Bulletin: Vulnerability in embedded IBM Websphere Application Server Liberty affects IBM Watson Compare and Comply for IBM Cloud Pak for Data

Summary WebSphere liberty is vulnerable to a DOS Vulnerability Details CVEID: CVE-2019-4720 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability ...

Code Injection in vishwanatharondekar/gitlab-cli

Description The git-lab-cli module is vulnerable against RCE since a command is crafted using user inputs not validated and then executedading to arbitrary command injection POC 1. Check there aren't files called HACKED 2. Execute the following commands in another terminal: bash npm i git-lab-cli...