Huawei EulerOS: Security Advisory for binutils (EulerOS-SA-2020-2239)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : spamassassin (EulerOS-SA-2020-2272)

According to the versions of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain...

CVE-2020-5936

On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile...

F5 Networks BIG-IP : BIG-IP Client SSL Security Advisory (K44020030)

The Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile. Impact TMM memory may eventually become exhausted and may result in the system producing a core file. The BIG-IP system may...

CVE-2020-16262

Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation...

Amazon Linux 2 : libcroco (ALAS-2020-1521)

The version of libcroco installed on the remote host is prior to 0.6.12-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1521 advisory. A stack overflow flaw was found in libcroco. A service using libcroco's CSS parser could be crashed by a local, authenticated...

Medium: spamassassin

Issue Overview: In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly. CVE-2019-12420 Affected Packages: spamassassin Note: This advisory is...

Amazon Linux 2 : spamassassin (ALAS-2020-1545)

The version of spamassassin installed on the remote host is prior to 3.4.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1545 advisory. In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as so...

Denial of service

The BASS Audio Library 2.4.14 under Windows is prone to a BASSStreamCreateFile Denial of Service vulnerability infinite loop via a crafted .mp3 file. This weakness could allow attackers to consume excessive CPU and the application becomes unresponsive...

MOXA NPort IAW5000A-I/O Series

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: MOXA Equipment: NPort IAW5000A-I/O Series Vulnerabilities: Session Fixation, Improper Privilege Management, Weak Password Requirements, Cleartext Transmission of Sensitive Information, Improper...

Ubuntu: Security Advisory (USN-4564-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS : Apache Tika vulnerabilities (USN-4564-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4564-1 advisory. It was discovered that Apache Tika can have an excessive memory usage by using a crafted or corrupt PSD file. An attacker could use it to cause a denial ...

Huawei EulerOS: Security Advisory for libcroco (EulerOS-SA-2020-2105)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AppArmor mount rules grant excessive permissions

...

Denial Of Service (DoS)

binutils is vulnerable to Denial Of Service DoS. demangletemplate in cplus-dem.c in GNU libiberty allows attackers to trigger excessive memory consumption aka OOM during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump...

Denial Of Service (DoS)

binutils is vulnerable to denial of service DoS. The vulnerability exists through an excessive memory allocation in bfdelfslurpversiontables in elf.c...

Code injection

An issue was discovered in Gradle Enterprise 2018.5. An attacker can potentially make repeated attempts to guess a local user's password, due to lack of lock-out after excessive failed logins...

Denial Of Service (DoS)

openjpeg is vulnerable to denial of service DoS. The vulnerability exists as through an excessive iteration in the opjt1encodecblks function of openjp2/t1.c...

Siemens SIMATIC HMI Products (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC HMI Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Authentication Bypass by Primary Weakness 2. UPDATE INFORMATION This updated advisory is a...

EulerOS Virtualization for ARM 64 3.0.2.0 : libjpeg-turbo (EulerOS-SA-2020-1949)

According to the versions of the libjpeg-turbo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in getrgbrow in rdppm.c via a malforme...