Lack of validation in data format attributes in TensorFlow

Impact The tf.rawops.DataFormatVecPermute API does not validate the srcformat and dstformat attributes. The code assumes that these two arguments define a permutation of NHWC. However, these assumptions are not checked and this can result in uninitialized memory accesses, read outside of bounds a...

Valve's Steam Server Bugs Could've Let Hackers Hijack Online Games

Critical flaws in a core networking library powering Valve's online gaming functionality could have allowed malicious actors to remotely crash games and even take control over affected third-party game servers. "An attacker could remotely crash an opponent's game client to force a win or even...

NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0083)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: - Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory...

NewStart CGSL CORE 5.04 / MAIN 5.04 : libexif Vulnerability (NS-SA-2020-0082)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libexif packages installed that are affected by a vulnerability: - An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. Thi...

SUSE SLES12 Security Update : xen (SUSE-SU-2020:2786-1)

This update for xen fixes the following issues : CVE-2020-25602: Fixed an issue where there was a crash when handling guest access to MSRMISCENABLE was thrown bsc1176339,XSA-333 CVE-2020-25598: Added a missing unlock in XENMEMacquireresource error path bsc1176341,XSA-334 CVE-2020-25604: Fixed a...

CVE-2020-23736

There is a local denial of service vulnerability in DaDa accelerator 5.6.19.816,, attackers can use constructed programs to cause computer crashes BSOD...

Denial of service

There is a local denial of service vulnerability in DaDa accelerator 5.6.19.816,, attackers can use constructed programs to cause computer crashes BSOD...

CVE-2020-23736

There is a local denial of service vulnerability in DaDa accelerator 5.6.19.816,, attackers can use constructed programs to cause computer crashes BSOD...

Trend Micro InterScan Web Security Virtual Appliance Stack Overflow (CVE-2020-28578; CVE-2020-28579)

A stack overflow vulnerability exists in Trend Micro InterScan Web Security Virtual Appliance. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

httpd: mod_http2 concurrent pool usage

A flaw was found in Apache httpd in versions 2.4.20 to 2.4.43. Logging using the wrong pool by modhttp2 at debug/trace log level may lead to potential crashes and denial of service. The highest threat from this vulnerability is to system availability...

YATinyWinFTP - Denial of Service Exploit

Exploit Title: YATinyWinFTP - Denial of Service PoC Google Dork: None Exploit Author: strider Vendor Homepage: https://github.com/ik80/YATinyWinFTP Software Link: https://github.com/ik80/YATinyWinFTP Tested on: Windows 10 ------------------------------Description---------------------------------...

CVE-2020-26237

Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow use...

CVE-2020-26237

Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow use...

Crestron Stack Overflow (CVE-2019-3930)

A stack overflow vulnerability exists in Crestron. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Amazon Linux AMI : kernel (ALAS-2020-1446)

The version of kernel installed on the remote host is prior to 4.14.203-116.332. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1446 advisory. In binderreleasework of binder.c, there is a possible use-after-free due to improper locking. This could lead to...

CVE-2020-27524

On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version N+RCNAUP0395 mishandles %x and %s format string specifiers in a device name. This may lead to memory content leaks and potentially crash the services...

CVE-2020-27524

On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version N+RCNAUP0395 mishandles %x and %s format string specifiers in a device name. This may lead to memory content leaks and potentially crash the services...

Amazon Linux 2 : kernel (ALAS-2020-1556)

The version of kernel installed on the remote host is prior to 4.14.203-156.332. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1556 advisory. In binderreleasework of binder.c, there is a possible use-after-free due to improper locking. This could lead to...

Adobe Acrobat and Reader Buffer Overflow (APSB20-67: CVE-2020-24435)

A buffer overflow vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

OPENSUSE-SU-2020:1882-1 Security update for wireshark

This update for wireshark fixes the following issues: - Update to wireshark 3.2.7: CVE-2020-25863: MIME Multipart dissector crash bsc1176908 CVE-2020-25862: TCP dissector crash bsc1176909 CVE-2020-25866: BLIP dissector crash bsc1176910 CVE-2020-17498: Kafka dissector crash bsc1175204 This update...