CVE-2020-7787

This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is cause...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Netty

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Netty. Vulnerability Details CVEID: CVE-2019-16869 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual whitespaces before the colon in HTTP headers. By sending a...

GHSA-8CV5-P934-3HWP Denial of service in fast-csv

Impact Possible ReDoS Regular Expression Denial of Service when using ignoreEmpty option when parsing. Patches This has been patched in v4.3.6 Workarounds You will only be affected by this if you use the ignoreEmpty parsing option. If you do use this option it is recommended that you upgrade to t...

Exploit for CVE-2020-1472

CVE-2020-1472 is a vulnerability in the Windows Netlogon service that allows an unauthenticated attacker to set the password of the Domain Controller account to an empty string NT hash=31d6cfe0d16ae931b73c59d7e0c089c0. This vulnerability is also known as the "Zerologon" vulnerability. The exploit...

C2FO Fast-csv Resource Management Error Vulnerability

C2FO Fast-csv is a Typescript-based code library for parsing and formatting CSV-formatted files from Packwood C2FO. A security vulnerability exists in Fast-csv, which stems from a possible re-dos vulnerability regular expression denial of service when parsing with the ignoreEmpty option...

Linux-PAM: Authentication bypass

Background Linux-PAM Pluggable Authentication Modules is an architecture allowing the separation of the development of privilege granting software from the development of secure and appropriate authentication schemes. Description A flaw was found in Linux-Pam in the way it handle empty passwords...

go-json-iterator:fuzz_json: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6333100707676160 Project: go-json-iterator Fuzzing Engine: libFuzzer Fuzz Target: fuzzjson Job Type: libfuzzerasango-json-iterator Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fff9c031e6b Crash State: NULL Sanitizer: address ASAN...

suricata:fuzz_sigpcap: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5117033767370752 Project: suricata Fuzzing Engine: libFuzzer Fuzz Target: fuzzsigpcap Job Type: libfuzzerubsansuricata Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: undefined UBSAN...

CVE-2020-7780

This affects the package com.softwaremill.akka-http-session:core2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection...

minify:minify-mediatype-fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5964843684986880 Project: minify Fuzzing Engine: libFuzzer Fuzz Target: minify-mediatype-fuzzer Job Type: libfuzzerasanminify Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000039ab1970 Crash State: NULL Sanitizer: address ASAN...

PT-2020-16800

Name of the Vulnerable Software and Affected Versions Linux-Pam versions prior to 1.5.1 Description A flaw was found in the way Linux-Pam handles empty passwords for non-existing users. When the user does not exist, PAM attempts to authenticate with root, and in the case of an empty password, it...

CVE-2020-27780

A flaw was found in Linux-PAM in the way it handles empty passwords for non-existing users. When the user doesn't exist, PAM tries to authenticate with root and with an empty password, authentication is successful. The highest threat from this vulnerability is to confidentiality, integrity, as we...

usrsctp:fuzzer_listen: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5647830429204480 Project: usrsctp Fuzzing Engine: libFuzzer Fuzz Target: fuzzerlisten Job Type: libfuzzermsanusrsctp Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory MSAN...

DEBIAN-CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

UBUNTU-CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

CVE-2019-20933: Improper Authentication

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

Influxdata InfluxDB 授权问题漏洞

InfluxDB is an open source temporal database developed by InfluxData. An authentication bypass vulnerability exists in the authenticate function in services/httpd/handler.go in versions prior to InfluxDB 1.7.6. The vulnerability stems from the fact that JWT tokens may have an empty SharedSecret. ...

grok:grk_decompress_fuzzer: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5154201226969088 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory MSAN...

Information Exposure

Overview spreeapi is a Spree Api module Affected versions of this package are vulnerable to Information Exposure. An attacker can query the API v2 Order Status endpoint with an empty string passed as an Order token. Remediation Upgrade spreeapi to version 3.7.13, 4.0.5, 4.1.12 or higher. Referenc...

SUSE-OU-2020:3291-1 Optional update for python-redis and redis

This optional update for python-redis and redis provides the following fixes python-redis: - Update to version to 3.4.1 jscECO-2417 Move the username argument in the Redis and Connection classes to the end of the argument list. This helps those poor souls that specify all their connection options...