panic safety: double drop may happen within `util::{mutate, mutate2}`

Upon panic in a user-provided function f, fn mutate & fn mutate2 drops twice a same object. Affected versions of this crate did not guard against double drop while temporarily duplicating an object's ownership with ptr::read. Dropping a same object can result in memory corruption. The flaw was...

ALPINE-CVE-2020-8287

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request for example, two Transfer-Encoding header fields. In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling...

CVE-2020-27483

Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the offset provided...

CVE-2020-27483

Garmin Forerunner 235 before 8.20 is affected by an Array index error in the ConnectIQ TVM. The attacker must upload a malicious ConnectIQ application to the ConnectIQ store; the interpreter trusts an offset for the stack value duplication instruction (DUP) that is unchecked, allowing memory befo...

Denial Of Service (DoS)

github.com/brocaar/chirpstack-network-server is vulnerable to denial of service DoS. Mishandling of de-duplication at the MQTT backend allows an attacker to cause a denial of service condition by sending malicious frequency attributes to CollectAndCallOnceCollect in internal/uplink/collect.go...

[SECURITY] Fedora 31 Update: kata-ksm-throttler-1.11.1-1.fc31.1

This project implements a Kernel Same-page Merging throttling daemon. The Kata Containers runtime creates a virtual machine VM to isolate a set of container workloads. The VM requires a guest kernel and a guest operating system "guest OS" to boot and create containers inside the guest environment...

Fedora: Security Advisory for kata-ksm-throttler (FEDORA-2020-15a1bde727)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Copying a Key by Listening to It in Action

Researchers are using recordings of keys being used in locks to create copies. Once they have a key-insertion audio file, SpiKey's inference software gets to work filtering the signal to reveal the strong, metallic clicks as key ridges hit the lock's pins and you can hear those filtered clicks...

Product release: Virtuozzo Hybrid Infrastructure 3.5 Update 5 (3.5.5-26)

This update provides a new feature as well as improvements and bug fixes. Vulnerability id: VSTOR-34750 After failed VM evacuations, resource allocations are duplicated. Vulnerability id: VSTOR-30767 An update to a new major release may fail with the error "Updates to multiple product versions ar...

CVE-2020-15093: Improper Verification of Cryptographic Signature

The tough library Rust/crates.io prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A...

CVE-2020-14151

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-11813. Reason: This candidate is a duplicate of CVE-2018-11813. Notes: All CVE users should reference ID instead of this candidate. All...

WooCommerce < 4.1.0 - Unescaped Metadata when Duplicating Products

The WooCommerce changelog file was updated with the following message: "Security – Fixed unescaped meta data while duplicating products. Reported by Slavco." We will update this issue with further information as it becomes available...

CVE-2020-10707

CVE-2020-10707 is a reservation duplicate of CVE-2020-11612. The active entry is CVE-2020-11612, describing Netty’s ZlibDecoders vulnerability: unbounded memory allocation when decoding a ZlibEncoded stream, potentially exhausting memory resources. Remediation is to upgrade to a fixed Netty versi...

MS12-051: Vulnerability in Microsoft Office for Mac could allow elevation of privilege: July 10, 2012

Describes the Microsoft Office for Mac 2011 14.2.3 Update that was released on July 10, 2012INTRODUCTIONMicrosoft has released security bulletin MS12-051. This security bulletin contains all the relevant information about the security update for Microsoft Office for Mac 2011. To view the complete...

Mail.ru: [icq.com/people/*uin*/edit] Отсутствует фильтр и проверка на дубли в поле "Никнейм"

It was possible to create account with a same nickname wih existing one...

CVE-2015-1387

CVE-2015-1387 is a reservation duplicate of CVE-2015-1454. Connected records confirm a MitM certificate-validation flaw in Blue Coat ProxyClient and Unified Agent: ProxyClient &lt;3.3.3.3 and 3.4.x &lt;3.4.4.10; Unified Agent

CVE-2014-3893

CVE-2014-3893 is a duplicate of CVE-2014-0114. Connected docs provide concrete details for CVE-2014-0114 (Apache Struts 1.x): remote code execution via ClassLoader manipulation in the Struts ActionForm, with fixes/mitigations across affected products. Remedies noted include upgrading to patched A...

CVE-2013-3621

CVE-2013-3621 is a reserved/duplicate of CVE-2013-3607, but connected documents discuss Supermicro IPMI CGI vulnerabilities: unauthenticated buffer‑overflow flaws in the login.cgi/close_window.cgi components on Supermicro IPMI firmware CGI, enabling remote code execution on affected BMCs. Documen...

RUSTSEC-2019-0029 ChaCha20 counter overflow can expose repetitions in the keystream

The ChaCha20 stream cipher can produce a maximum of 2^32 blocks 256GB before the 32-bit counter overflows. Releases of the chacha20 crate prior to v0.2.3 allow generating keystreams larger than this, including seeking past the limit. When this occurs, the keystream is duplicated, with failure mod...

ChaCha20 counter overflow can expose repetitions in the keystream

The ChaCha20 stream cipher can produce a maximum of 2^32 blocks 256GB before the 32-bit counter overflows. Releases of the chacha20 crate prior to v0.2.3 allow generating keystreams larger than this, including seeking past the limit. When this occurs, the keystream is duplicated, with failure mod...