go-json-iterator:fuzz_json: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6333100707676160 Project: go-json-iterator Fuzzing Engine: libFuzzer Fuzz Target: fuzzjson Job Type: libfuzzerasango-json-iterator Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fff9c031e6b Crash State: NULL Sanitizer: address ASAN...

suricata:fuzz_sigpcap: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5117033767370752 Project: suricata Fuzzing Engine: libFuzzer Fuzz Target: fuzzsigpcap Job Type: libfuzzerubsansuricata Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: undefined UBSAN...

CVE-2020-7780

This affects the package com.softwaremill.akka-http-session:core2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection...

minify:minify-mediatype-fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5964843684986880 Project: minify Fuzzing Engine: libFuzzer Fuzz Target: minify-mediatype-fuzzer Job Type: libfuzzerasanminify Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000039ab1970 Crash State: NULL Sanitizer: address ASAN...

PT-2020-16800

Name of the Vulnerable Software and Affected Versions Linux-Pam versions prior to 1.5.1 Description A flaw was found in the way Linux-Pam handles empty passwords for non-existing users. When the user does not exist, PAM attempts to authenticate with root, and in the case of an empty password, it...

CVE-2020-27780

A flaw was found in Linux-PAM in the way it handles empty passwords for non-existing users. When the user doesn't exist, PAM tries to authenticate with root and with an empty password, authentication is successful. The highest threat from this vulnerability is to confidentiality, integrity, as we...

usrsctp:fuzzer_listen: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5647830429204480 Project: usrsctp Fuzzing Engine: libFuzzer Fuzz Target: fuzzerlisten Job Type: libfuzzermsanusrsctp Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory MSAN...

DEBIAN-CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

UBUNTU-CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

CVE-2019-20933: Improper Authentication

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

Influxdata InfluxDB Authorization Issue Vulnerability

InfluxDB is an open source temporal database developed by InfluxData. An authentication bypass vulnerability exists in the authenticate function in services/httpd/handler.go in versions prior to InfluxDB 1.7.6. The vulnerability stems from the fact that JWT tokens may have an empty SharedSecret. ...

grok:grk_decompress_fuzzer: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5154201226969088 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory MSAN...

Information Exposure

Overview spreeapi is a Spree Api module Affected versions of this package are vulnerable to Information Exposure. An attacker can query the API v2 Order Status endpoint with an empty string passed as an Order token. Remediation Upgrade spreeapi to version 3.7.13, 4.0.5, 4.1.12 or higher. Referenc...

SUSE-OU-2020:3291-1 Optional update for python-redis and redis

This optional update for python-redis and redis provides the following fixes python-redis: - Update to version to 3.4.1 jscECO-2417 Move the username argument in the Redis and Connection classes to the end of the argument list. This helps those poor souls that specify all their connection options...

dovecot security update

1:2.3.8-4 - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts 1866756 - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation 1866761 - fix CVE-2020-12674 crash due to assert in RPA implementation 1866768 1:2.3.8-3 - fix CVE-2020-10957 dovecot: malformed NOOP...

grok:grk_decompress_fuzzer: Nested bug in the same thread, aborting. with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5645221567922176 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id: linux Crash Type: Nested bug in the same thread, aborting. Crash Address: Crash State: NULL Sanitizer: memory MSAN...

PYSEC-2020-159

In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for...

CVE-2020-26214

In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for...

GHSA-5HMM-X8Q8-W5JH LDAP authentication bypass with empty password

Impact Users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated binds eg. default on Active Directory are affected. Patch...

LDAP authentication bypass with empty password

Impact Users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated binds eg. default on Active Directory are affected. Patch...