Medium: spamassassin

Issue Overview: In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly. CVE-2019-12420 Affected Packages: spamassassin Note: This advisory is...

Amazon Linux 2 : spamassassin (ALAS-2020-1545)

The version of spamassassin installed on the remote host is prior to 3.4.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1545 advisory. In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as so...

CVE-2020-15906: Improper Restriction of Excessive Authentication Attempts

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts...

Denial of service

The BASS Audio Library 2.4.14 under Windows is prone to a BASSStreamCreateFile Denial of Service vulnerability infinite loop via a crafted .mp3 file. This weakness could allow attackers to consume excessive CPU and the application becomes unresponsive...

MOXA NPort IAW5000A-I/O Series

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: MOXA Equipment: NPort IAW5000A-I/O Series Vulnerabilities: Session Fixation, Improper Privilege Management, Weak Password Requirements, Cleartext Transmission of Sensitive Information, Improper...

Ubuntu: Security Advisory (USN-4564-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS : Apache Tika vulnerabilities (USN-4564-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4564-1 advisory. It was discovered that Apache Tika can have an excessive memory usage by using a crafted or corrupt PSD file. An attacker could use it to cause a denial ...

Huawei EulerOS: Security Advisory for libcroco (EulerOS-SA-2020-2105)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AppArmor mount rules grant excessive permissions

...

Denial Of Service (DoS)

binutils is vulnerable to Denial Of Service DoS. demangletemplate in cplus-dem.c in GNU libiberty allows attackers to trigger excessive memory consumption aka OOM during the "Create an array for saving the template argument values" XNEWVEC call. This can occur during execution of objdump...

Denial Of Service (DoS)

binutils is vulnerable to denial of service DoS. The vulnerability exists through an excessive memory allocation in bfdelfslurpversiontables in elf.c...

Code injection

An issue was discovered in Gradle Enterprise 2018.5. An attacker can potentially make repeated attempts to guess a local user's password, due to lack of lock-out after excessive failed logins...

Denial Of Service (DoS)

openjpeg is vulnerable to denial of service DoS. The vulnerability exists as through an excessive iteration in the opjt1encodecblks function of openjp2/t1.c...

CVE-2020-13312: Improper Restriction of Excessive Authentication Attempts

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a specific parameter...

Huawei EulerOS: Security Advisory for libjpeg-turbo (EulerOS-SA-2020-1949)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Siemens SIMATIC HMI Products (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC HMI Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Authentication Bypass by Primary Weakness 2. UPDATE INFORMATION This updated advisory is a...

EulerOS Virtualization for ARM 64 3.0.2.0 : libjpeg-turbo (EulerOS-SA-2020-1949)

According to the versions of the libjpeg-turbo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in getrgbrow in rdppm.c via a malforme...

Denial Of Service (DoS)

samba is vulnerable to denial of service. A remote attacker is able to cause the Samba server to consume excessive CPU resources which could lead to an application crash...

MGASA-2020-0364 Updated python-rsa packages fix security vulnerability

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

Huawei EulerOS: Security Advisory for libcroco (EulerOS-SA-2020-1922)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...