Security Bulletin: IBM Verify Gateway PAM components do not set restricted access permission for debug logs (CVE-2020-4405)

Summary To debug the IBM Verify Gateway IVG PAM components, customers can add "trace-file" parameters in the PAM configuration so that .log files are written to the /tmp directory. These debug logs potentially contain sensitive information, and yet they default to world readable. They should have...

nodejs:12 security update

nodejs 1:12.21.0-1 - Resolves: RHBZ1932315, RHBZ1932424 - remove --debug-nghttp2 option - remove ini patch - Backport patch to use getauxval...

nodejs:10 security update

nodejs 1:10.24.0-1 - Resolves: RHBZ1932373, RHBZ1932426 - Resolves CVE-2021-22883 and CVE-2021-22884 - remove -debug-nghttp2 flag 1930775 - remove ini patch merged upstream...

Cross-Site Scripting (XSS)

nanohttpd is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript code in a user's browser via the GeneralHandler class that implements a basic GET handler which prints debug information as an HTML page...

Owncloud ownCloud 权限许可和访问控制问题漏洞

OwnCloud OwnCloud is a personal cloud storage solution from OwnCloud Owncloud, an American company. OwnCloud has a permission and access control issue vulnerability that can be exploited by an attacker to bypass the PIN locking feature by making a restore from this archive, using adb to include t...

Information disclosure

Debug message containing addresses of memory transactions in some IntelR 10th Generation Core Processors supporting SGX may allow a privileged user to potentially enable information disclosure via local access...

CVE-2020-24491

Debug message containing addresses of memory transactions in some IntelR 10th Generation Core Processors supporting SGX may allow a privileged user to potentially enable information disclosure via local access...

CVE-2020-24491

CVE-2020-24491 concerns a potential information disclosure in Intel SGX on some 10th Generation Intel Core processors. The issue is triggered by a debug message that reveals addresses of memory transactions, which a privileged user could use to disclose information via local access. Affected prod...

CVE-2020-4954

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could...

Authentication flaw

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could...

CVE-2020-4954: Session Fixation

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could...

PT-2021-12251

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Operations Center versions 7.1 through 8.1 Description The issue is caused by improper session validation, allowing a remote attacker to bypass authentication restrictions. An attacker could exploit this by using the...

CVE-2020-4954

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could...

PT-2021-2087

Name of the Vulnerable Software and Affected Versions: Intel 10th Generation Core Processors supporting SGX affected versions not specified Description: The issue is related to a debug message containing addresses of memory transactions in some Intel 10th Generation Core Processors that support...

PT-2021-28052

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue is related to a global buffer overflow read, as indicated by an OSS-Fuzz report. The crash state involves functions such as vte write debug, do action, and parse data. No...

Beware: New Matryosh DDoS Botnet Targeting Android-Based Devices

A nascent malware campaign has been spotted co-opting Android devices into a botnet with the primary purpose of carrying out distributed denial-of-service DDoS attacks. Called "Matryosh" by Qihoo 360's Netlab researchers, the latest threat has been found reusing the Mirai botnet framework and...

openSUSE Security Update : sudo (openSUSE-2021-169)

This update for sudo fixes the following issues : - A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges bsc1181090,CVE-2021-3156 - It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit...

openSUSE Security Update : sudo (openSUSE-2021-170)

This update for sudo fixes the following issues : - A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges bsc1181090,CVE-2021-3156 - It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit...

OPENSUSE-SU-2021:0169-1 Security update for sudo

This update for sudo fixes the following issues: - A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges bsc1181090,CVE-2021-3156 - It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit...

SUSE SLES12 Security Update : sudo (SUSE-SU-2021:0226-1)

This update for sudo fixes the following issues : A Heap-based buffer overflow in sudo could be exploited to allow a user to gain root privileges bsc1181090,CVE-2021-3156 It was possible for a user to test for the existence of a directory due to a Race Condition in sudoedit...