CVE-2021-21148

Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Recent assessments: gwillcox-r7 at February 05, 2021 4:25pm UTC reported: Reported as exploited in the wild at...

ai4bharat-transliteration (>=1.1.0 <=1.1.3), aipack (>=0.0.1 <=0.0.5) +53 more potentially affected by CVE-2020-26268 via tensorflow (>=2.0.0 <=2.0.3)

tensorflow PYPI version =2.0.0, =1.1.0, =0.0.1, =0.1.3.2, =0.2.6, =0.2.0, =0.0.2, =1.0.0.1, =0.0.1, =1.0.4, =0.6.0.post3, =0.1.3, =1.0.0, =1.0.1 and more Source cves: CVE-2020-26268 Source advisory: OSV:PYSEC-2020-255...

Design/Logic Flaw

u'When a non standard SIP sigcomp message is received from the network, then there may be chances of using more UDVM cycle or memory overflow' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8017,...

VMware ESXi OpenSLP Remote Code Execution Vulnerability (CVE-2020-3992 and CVE-2019-5544): What You Need To Know

What’s up? On November 6, 2020 Microsoft’s Kevin Beaumont alerted the community to evidence of active exploitation attempts of CVE-2020-3992 and/or CVE-2019-5544, which are remote code execution RCE vulnerabilities in VMware ESXi’s service location protocol SLP service. VMware had issued a patch...

Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity

Summary The Cybersecurity and Infrastructure Security Agency CISA has consistently observed Chinese Ministry of State Security MSS-affiliated cyber threat actors using publicly available information sources and common, well-known tactics, techniques, and procedures TTPs to target U.S. Government...

CVE-2020-6086

An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malicious...

CVE-2020-6086

An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malicious...

CVE-2020-6086

An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malicious...

CVE-2020-14378

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the movedesc function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause movedesc to get stuck in a 4,294,967,295-count iteration loop. Depending on how vhostcrypto is...

CVE-2020-14378

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the movedesc function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause movedesc to get stuck in a 4,294,967,295-count iteration loop. Depending on how vhostcrypto is...

CVE-2020-14378

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the movedesc function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause movedesc to get stuck in a 4,294,967,295-count iteration loop. Depending on how vhostcrypto is...

Information Leakage Vulnerability in Store Life Cycle Control System of Nanjing Ponte Software Technology Co.

NanjingPartnerSoftwareTechnologyCo.,Ltd. wisdom. Chain is a software sales, development and service in one of the professional software company. NanjingPartnerSoftwareTechnologyCo.,Ltd. store lifecycle control system there is an information leakage vulnerability, attackers can use the vulnerabili...

SQL Injection Vulnerability in Store Life Cycle Control System of Nanjing Ponte Software Technology Co.

NanjingPartnerSoftwareTechnologyCo.,Ltd. wisdom. Chain is a software sales, development and service in one of the professional software company. NanjingPartnerSoftwareTechnologyCo., Ltd. store lifecycle management and control system there is a SQL injection vulnerability, an attacker can use the...

CVE-2020-7524

Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller V5.0.0.7 and prior which could cause Denial of Service when sending specific crafted IPV4 packet to the controller: Sending a specific IPv4 protocol package to Schneider Electric Modicon M218 Logic Controller can cause IPv4...

CVE-2020-16138

A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our...

Information disclosure

A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our...

CVE-2020-16138

A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our...

PT-2020-14770 · Cisco · Cisco Unified Ip Conference Station 7937G

Name of the Vulnerable Software and Affected Versions: Cisco Unified IP Conference Station 7937G versions 1-4-4-0 through 1-4-5-7 Description: A denial-of-service issue allows attackers to remotely disable the device until it is power cycled. The product is end of life and users are advised to...

What’s in a Name? – Why Gartner Picking “Application Vulnerability Correlation” is an Important Step for the Application Security Market

If you havent seen it yet, Gartner just published its "Hype Cycle for Application Security, 2016" written by Gartner Analyst Ayal Tirosh with support from colleague Lawrence Pingree Gartner clients can view it at https://www.gartner.com/doc/3376617/hype-cycle-application-security-. This is...

NOTICE-OF-CHANGE ANNOUNCEMENT FOR CITRIX SD-WAN 5100 Standard Edition and 800 WANOP Edition

Citrix Systems, Inc. announces a Notice of Status Change for the Citrix SD-WAN 5100 Standard Edition and 800 WANOP Edition platforms. The tables below explain the Citrix SD-WAN life cycle management milestones as well as important information regarding dates and options during this period. The...