PT-2020-13788

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions 2.5.0 through 2.13.0 Description A specially crafted MQTT packet with an XSS payload as client-id or topic name can exploit this issue. The XSS payload is injected into the admin console's browser and is...

Security Bulletin: Vulnerability in SSLv3 affects IBM SmartCloud Entry (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM SmartCloud Entry. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

OPENSUSE-SU-2020:1001-1 Security update for rubygem-puma

This update for rubygem-puma to version 4.3.5 fixes the following issues: - CVE-2020-11077: Fixed a HTTP smuggling issue related to proxy usage bsc1172175. - CVE-2020-11076: Fixed a HTTP smuggling issue when using an invalid transfer-encoding header bsc1172176. - Disabled TLSv1.0 and TLSv1.1...

PYSEC-2020-14

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler depending o...

SUSE-SU-2020:1919-1 Security update for rubygem-puma

This update for rubygem-puma to version 4.3.5 fixes the following issues: - CVE-2020-11077: Fixed a HTTP smuggling issue related to proxy usage bsc1172175. - CVE-2020-11076: Fixed a HTTP smuggling issue when using an invalid transfer-encoding header bsc1172176. - Disabled TLSv1.0 and TLSv1.1...

PT-2020-18975 · Silverstripe · Silverstripe

Name of the Vulnerable Software and Affected Versions: SilverStripe version 4.5.0 Description: The issue allows attackers to read certain records that should not have been placed into a result set. This is due to the automatic permission-checking mechanism in the silverstripe/graphql module not...

PT-2020-18974 · Silverstripe · Silverstripe

Name of the Vulnerable Software and Affected Versions: SilverStripe versions through 4.5.0 Description: A specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a SilverStripe application, without revealing the...

sane-backends security update

1.0.27-19.1 - 1852468, 1852467, 1852466, 1852465 - prevent buffer overflow in esci2img - 1852668, 1852667, 1852666, 1852665 - disable autodiscovery for epsonds backend...

PT-2020-3454

Name of the Vulnerable Software and Affected Versions Java SE versions 7u261, 8u251, 11.0.7, 14.0.1 Java SE Embedded version 8u251 Description The issue is related to the JAXP component and is caused by inadequate access control. It allows an unauthenticated attacker with network access via...

DEBIAN-CVE-2020-11061

In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched...

UBUNTU-CVE-2020-11061

In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched...

PT-2020-6421 · Cflow +2 · Cflow +2

Name of the Vulnerable Software and Affected Versions: cflow version 1.6 Description: The issue is related to a Use-after-Free vulnerability in the call function at src/parser.c, which could cause a denial of service via the pointer variable caller-callee. This vulnerability may allow an attacker...

PT-2022-2175 · Pjsip +3 · Pjsip +3

Name of the Vulnerable Software and Affected Versions: PJSIP versions up to and including 2.11.1 Description: The issue is related to the use of memory after it has been freed, potentially causing undefined behavior such as dialog list collision, which can lead to an endless loop. This occurs in ...

PT-2022-17984 · Sangoma +1 · Asterisk +1

Name of the Vulnerable Software and Affected Versions: Asterisk versions prior to 16.25.2 Asterisk versions prior to 18.11.2 Asterisk versions prior to 19.3.2 Certified Asterisk versions prior to 16.8-cert14 Description: An issue was discovered in the func odbc module, which provides possibly...

SUSE-SU-2020:1842-1 Security update for systemd

This update for systemd fixes the following issues: - CVE-2019-20386: Fixed a memory leak when executing the udevadm trigger command bsc1161436. - Renamed the persistent link for ATA devices bsc1164538 - shared/install: try harder to find enablement symlinks when disabling a unit bsc1157315 -...

PT-2021-10978 · Speex +8 · Speex +8

Name of the Vulnerable Software and Affected Versions: Speex version 1.2 Description: A Divide by Zero vulnerability in the function read samples of Speex allows attackers to cause a denial of service DoS via a crafted WAV file. Recommendations: For Speex version 1.2, as a temporary workaround,...

PT-2020-14546 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to write arbitrary files on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax mod...

PT-2020-14538 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax ftp...

glpi -- leakage issue with knowledge base

MITRE Corporation reports: In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ...

PT-2020-14529 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax admin apis.p...