CVE-2020-35875: Undefined Security Weakness

An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly...

Code injection

In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic ove...

CVE-2020-27724

In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic ove...

CVE-2020-27718

CVE-2020-27718 affects F5 BIG-IP ASM/Advanced WAF where processing JSON requests with many parameters can cause the bd process to spike CPU usage. Affected versions span BIG-IP ASM 11.6.1–11.6.5.2, 12.1.0–12.1.5.2, 13.1.0–13.1.3.4, 14.1.0–14.1.3, 15.1.0–15.1.0.5, and 16.0.0–16.0.0.1. The issue ca...

PT-2020-16784

Name of the Vulnerable Software and Affected Versions BIG-IP APM versions 13.1.0 through 13.1.3.4 BIG-IP APM versions 14.1.0 through 14.1.3 BIG-IP APM versions 15.0.0 through 15.0.1.3 Description The VDI plugin in BIG-IP APM does not observe plugin flow-control protocol under certain conditions,...

CVE-2020-27718: Undefined Security Weakness

When a BIG-IP ASM or Advanced WAF system running version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, or 11.6.1-11.6.5.2 processes requests with JSON payload, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process...

SUSE SLES12 Security Update : openssh (SUSE-SU-2020:3844-1)

This update for openssh fixes the following issues : CVE-2020-14145: Fixed an observable discrepancy leading to an information leak in the algorithm negotiation bsc1173513. Fixed an issue where AuthorizedKeysCommand produced a lot of output bsc1161684. Fixed an issue where oracle cluster with...

JFrog Artifactory < 7.10.5 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote machine is prior to 7.10.5. It is, therefore, affected by multiple vulnerabilities: - CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to...

EulerOS 2.0 SP5 : 389-ds-base (EulerOS-SA-2020-2539)

According to the versions of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An...

CVE-2020-28206

An issue was discovered in Bitrix24 Bitrix Framework 1c site management 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows...

Authentication flaw

An issue was discovered in Bitrix24 Bitrix Framework 1c site management 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also allows...

WESEEK GROWI Information Disclosure Vulnerability

Weseek WESEEK GROWI is a suite of team collaboration software from WESEEK Weseek Japan. An information disclosure vulnerability exists in GROWI versions 4.0.0 through 4.1.3, which stems from the application exporting too much data. The vulnerability allows a remote attacker to access potentially...

PT-2020-6735

Name of the Vulnerable Software and Affected Versions binutils versions prior to 2.36 Description The issue is related to insufficient input validation in the read section function of the dwarf2.c component in the GNU Binutils development tool. This allows a remote attacker to cause a denial of...

binutils -- excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c read_section()

Hao Wang reports: There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption...

Authentication flaw

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause unauthorized command execution when a brute force attack is done over Modbus...

CVE-2020-28212

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause unauthorized command execution when a brute force attack is done over Modbus...

Oracle Linux 8 : spamassassin (ELSA-2020-4625)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4625 advisory. - Fixed CVE-2018-11805 - Fixed CVE-2020-1930 - Fixed CVE-2020-1931 - Fix CVE-2019-12420 Tenable has extracted the preceding description block directly...

Security Bulletin: IBM API Connect V5 is vulnerable to denial of service (CVE-2019-11479)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-11479 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a flaw when processing minimum segment size MSS. By sending specially-crafted MSS traffic, a remote attacker cou...

EulerOS Virtualization 3.0.6.6 : samba (EulerOS-SA-2020-2476)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC...

Huawei EulerOS: Security Advisory for libcroco (EulerOS-SA-2020-2447)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...