OPENSUSE-SU-2020:0520-1 Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.7.0 fixes the following issues: - CVE-2020-6819: Use-after-free while running the nsDocShell destructor boo1168630 - CVE-2020-6820: Use-after-free when handling a ReadableStream boo1168630 - CVE-2020-6821: Uninitialized memory could be read when...

The vulnerability of Xen hypervisors arises from synchronization errors when using shared resources, allowing a malicious actor to cause service failures or increase their privileges.

The vulnerability of Xen hypervisors arises due to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause service failures or increase their privileges by adding a device with persistent communication capabilities...

Siemens SIMOTICS, Desigo, APOGEE, and TALON

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable from an adjacent network/low skill level to exploit Vendor: Siemens Equipment: SIMOTICS, Desigo, APOGEE, and TALON Vulnerability: Business Logic Errors 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled...

The vulnerability of the Firefox software, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise data integrity.

The vulnerability of the Firefox software, specifically Firefox-esr, is related to an error in the insertion of certain tags from the buffer. These tags are incorrectly associated with the namespace rules. Exploiting this vulnerability can allow a remote attacker to compromise data integrity...

MS15-036: Description of the security update for SharePoint Server 2013: April 14, 2015

Resolves vulnerabilities in Microsoft Office server and productivity software that could allow elevation of privilege if an attacker sends a specially crafted request to an affected SharePoint Server.IntroductionThis security update resolves elevation of privilege vulnerabilities that exist when...

Denial Of Service (DoS)

mysql is vulnerable to denial of service DoS. The vulnerability exists as a flaw in the way MySQL handled LOAD DATA INFILE requests allowed MySQL to send OK packets even when there were errors...

Denial Of Service (DoS)

webkitgtk is vulnerable to denial of service DoS. The vulnerability exists through two array index errors, leading to out-of-bounds memory reads, were found in WebKit. Malicious web content could cause an application using WebKitGTK+ to crash...

CentOS 7 : evolution (RHSA-2020:1080)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1080 advisory. - GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a...

The vulnerability of the Open Build Service software platform, related to authentication errors, allows attackers to circumvent existing security restrictions and execute a type of “man-in-the-middle” attack.

The vulnerability of the Open Build Service software platform is related to errors in verifying the authenticity of certificates. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute a type of “man-in-the-middle” attack...

The vulnerability of the Grafana data representation web tool, related to authentication errors, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Grafana data presentation web tool is related to authentication errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Update for RDP 8.1 is available for Windows 7 SP1

Update for RDP 8.1 is available for Windows 7 SP1 Summary This article describes an update for the Remote Desktop Protocol RDP 8.1 in Windows 7 Service Pack 1 SP1 and Windows Server 2008 R2 SP1. This update package provides the following improvements: Fixes connection reliability issues. Provides...

Protected content playback errors on Windows 8 or Windows Server 2012 after you install KB 2756872

Protected content playback errors on Windows 8 or Windows Server 2012 after you install KB 2756872 Symptoms Consider the following scenario: You have a computer that is running Windows 8 or Windows Server 2012. You install the update in the following Microsoft Knowledge Base article: 2756872...

Stop error code 0xD1, 0x139, or 0x3B and cluster nodes go down in Windows Server 2012 R2 or Windows Server 2012

Stop error code 0xD1, 0x139, or 0x3B and cluster nodes go down in Windows Server 2012 R2 or Windows Server 2012 Symptoms Issue 1 When you delete network interfaces on a server that is running Windows Server 2012 R2 or Windows Server 2012, you experience random and intermittent crashes on the...

CVE-2020-4164

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be used in further attacks against the system. IBM X-Force ID: 174400...

Design/Logic Flaw

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be used in further attacks against the system. IBM X-Force ID: 174400...

CVE-2020-4164

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be used in further attacks against the system. IBM X-Force ID: 174400...

Security Bulletin: IBM Security Information Queue could reveal sensitive data in application error messages (CVE-2020-4164)

Summary In response to certain application errors, IBM Security Information Queue ISIQ could output messages that contain sensitve data, which could then be used to gain unauthorized system access. As of v1.0.6, ISIQ no longer includes sensitve data when outputting error messages. Vulnerability...

Node.js third-party modules: Prototype pollution attack (lodash)

I would like to report a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype. Module module name: lodash version: 4.17.15 npm page: https://www.npmjs.com/package/lodash Module Description A modern JavaScript utility library delivering...

The vulnerability of microprogramming software in the Cisco Nexus 1000V virtual switch allows a intruder to trigger a service failure.

The vulnerability of microprogrammed software in the Cisco Nexus 1000V virtual switch is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

DotNetNuke Cookie Deserialization Remote Code Execution Exploit

This Metasploit module exploits a deserialization vulnerability in DotNetNuke DNN versions 5.0.0 through 9.3.0-RC. Vulnerable versions store profile information for users in the DNNPersonalization cookie as XML. The expected structure includes a "type" attribute to instruct the server which type ...