CVE-2020-28367

An input validation vulnerability was found in Go. If cgo is specified in a Go file, it is possible to bypass the validation of arguments to the gcc compiler. This flaw allows an attacker to create a malicious repository that can execute arbitrary code when downloaded and run via go get or go bui...

CVE-2020-28366

An input validation vulnerability was found in Go. From a generated go file from the cgo tool, it is possible to modify symbols within that object file and specify code. This flaw allows an attacker to create a repository that includes malicious pre-built object files that could execute arbitrary...

Fedora 32 : firefox (2020-fc9085727a)

New upstream release 82.0.3 ---- - Built with mozilla-openh264 weak dependency ---- - Require mozilla-openh264 package - Add firefox testing scripts Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...

CVE-2020-5992

NVIDIA GeForce NOW application software on Windows, all versions prior to 2.0.25.119, contains a vulnerability in its open-source software dependency in which the OpenSSL library is vulnerable to binary planting attacks by a local user, which may lead to code execution or escalation of privileges...

3nit-utils (0.24.0), @8base/api-cli (>=0.0.1, <=0.1.0) +346 more potentially affected by CVE-2020-7769 via nodemailer (>=6.0.0, <=6.4.15)

nodemailer NPM version =6.0.0, =0.0.1, =1.16.0, =1.16.0, =1.16.1, =1.16.0, =1.16.0, =1.16.7, =1.16.0, =1.16.0, =1.16.0, =1.16.1, =1.2.1, =0.16.9, =0.17.0 - @agnostack/sync-moltin-to-shipstation 1.0.0 and more Source cves: CVE-2020-7769 Source advisory: SNYK:JS-NODEMAILER-1038834...

opentmpfiles Backlink Vulnerability

OpenRC opentmpfiles is the OpenRC team's software for working with tmpfiles.d files on systems that rely on the Systemd daemon for management. A security vulnerability exists in versions of opentmpfiles prior to 0.3.1 that allows a local user to have full privileges to arbitrary files...

openSUSE Security Update : MozillaThunderbird and mozilla-nspr (openSUSE-2020-1785)

This update for MozillaThunderbird and mozilla-nspr fixes the following issues : - Mozilla Thunderbird 78.4 - new: MailExtensions: browser.tabs.sendMessage API added - new: MailExtensions: messageDisplayScripts API added - changed: Yahoo and AOL mail users using password authentication will be...

Security update for binutils (moderate)

openSUSE Security Update: Security update for binutils Announcement ID: openSUSE-SU-2020:1790-1 Rating: moderate References: 1126826 1126829 1126831 1140126 1142649 1143609 1153768 1153770 1157755 1160254 1160590 1163333 1163744 Cross-References: CVE-2019-12972 CVE-2019-14250 CVE-2019-14444...

Security Bulletin: Apache CXF vulnerability identified in IBM Tivoli Application Dependency Discovery Manager (CVE-2020-1954)

Summary This security bulletin addresses the vulnerability in Open Source Apache CXF that affect IBM Tivoli Application Dependency Discovery Manager. Vulnerability Details CVEID: CVE-2020-1954 DESCRIPTION: Apache CXF is vulnerable to a man-in-the-middle attack, caused by a flaw in JMX Integration...

Security update for bind (moderate)

openSUSE Security Update: Security update for bind Announcement ID: openSUSE-SU-2020:1701-1 Rating: moderate References: 1100369 1109160 1118367 1118368 1128220 1156205 1157051 1161168 1170667 1170713 1171313 1171740 1172958 1173307 1173311 1173983 1175443 1176092 1176674 906079 Cross-References:...

Uber: RCE via npm misconfig -- installing internal libraries from the public registry

The hacker spotted some orphaned references to Uber-branded Node.js library packages and claimed them on the public NPM registry to run their own proof-of-concept code. Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies...

SUSE-SU-2020:2872-1 Security update for hexchat

This update for hexchat fixes the following issues: - CVE-2016-2087: A directory traversal was possible if a user could be convinced to connect to a server with a hostname with '..' in its name. bsc1020739. This non-security issue was fixed: - Add dependency on iso-codes and hwdata as hexchat tri...

Selenium arbitrary file read

If there is an open selenium web driver, a remote attacker can send requests to the victims browser. In certain cases this can be used to access to the remote file system. Module Options msf use auxiliary/gather/selenium/fileread msf undefinedfileread show actions ...actions... msf...

Dependency Confusion in Bundler with Implicit Private Dependencies

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that...

Fedora 31 : perl-DBI (2020-f30298614a)

This release fixes CVE-2020-14392 a memory corruption in XS functions when Perl stack is reallocated, CVE-2019-20919 a NULL profile dereference in dbiprofile, a documentation that old API functions are vulnerable to an overflow, and CVE-2020-14393 a buffer overlfow on an overlong DBD class name. ...

Smart DNS for the New Network Edge

People depend on the internet for just about everything: interacting, learning, transacting, traveling, working, and more. At the same time, the wireless evolution to 4G -- and soon 5G and Wi-Fi everywhere -- has given birth to an era of connected cars, smart sensors, and a multitude of other...

OPENSUSE-SU-2020:1468-1 Security update for slurm_18_08

This update for slurm1808 fixes the following issues: - Fix Authentication Bypass when Message Aggregation is enabled CVE-2020-12693 This fixes and issue where authentication could be bypassed via an alternate path or channel when message Aggregation was enabled. A race condition allowed a user t...

OPENSUSE-SU-2020:1455-1 Security update for libvirt

This update for libvirt fixes the following issues: - CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. bsc1161883, bsc1174458 This update was imported from the SUSE:SLE-15-SP2:Update update project...

Security Bulletin: Python vulnerability in IBM Tivoli Application Dependency Discovery Manager (CVE-2019-16935)

Summary Vulnerabilities in Open Source Python affect IBM Tivoli Application Dependency Discovery Manager. Vulnerability Details CVEID: CVE-2019-16935 DESCRIPTION: Python is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the python/Lib/DocXMLRPCServer.p...

Security Bulletin: [All] Python (Publicly disclosed vulnerability)

Summary Vulnerabilities in Open Source Python affect IBM Tivoli Application Dependency Discovery Manager. Vulnerability Details CVEID: CVE-2019-9948 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by improper input validation by the urllib. By sending a...