Default share permissions not respected for federated reshares

None...

CVE-2015-1877

The opengenericxdgmime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file...

Information Disclosure

tripleo-ansible is vulnerable to information disclosure. An attacker is able to view the Ansible log file during stack update and creation...

Microsoft ACL Shortcomings

Hi @ll, the following is a substantially shortened version of and Windows NT supports access control for almost all its objects, "How Security Descriptors and Access Control Lists Work" and "How Permissions Work" provide a comprehensive and exhaustive explanation. "Access Control Lists" provides ...

Foxit PhantomPDF Out-of-Bounds Read Vulnerability (CNVD-2021-26385)

Foxit PhantomPDF is China's Foxit Foxit company a PDF document reader. Foxit PhantomPDF suffers from an out-of-bounds read vulnerability when processing U3D objects in PDF files. The vulnerability is caused due to a lack of proper validation of user-supplied data, which could result in reading...

Maintain File Security during Compliance Scanning

Learn how to integrate security into the build process to protect downstream workflows from risk...

SUSE-SU-2021:0776-1 Security update for s390-tools

This update for s390-tools fixes the following issues: - Fixed an issue where IPL was not working when bootloader was installed on a SCSI disk with 4k physical blocksize without using a devicemapper target bsc1183041. - CVE-2021-25316: Do not use predictable temporary file names bsc1182777. - Mad...

CVE-2021-26222

The ezxmlnew function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool...

CVE-2020-26941

A local authenticated low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite deletion of any file via a symlink, due to insecure permissions. The possibility of exploiting this vulnerability is limited and can only take place during the installation...

Cross site scripting

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. Processing a maliciously crafted audio file may lead to arbitrary code execution...

Unauthorized File Access in glance

Versions of glance prior to 3.0.7 are vulnerable to Unauthorized File Access. The package provides a --nodot option meant to hide files and directories with names that begin with a ., such as .git but fails to hide files inside a folder that begins with .. Recommendation Upgrade to version 3.0.7 ...

PT-2020-14053 · Philips · Dreammapper

Name of the Vulnerable Software and Affected Versions: Philips DreamMapper versions 2.24 and prior Description: The issue allows information written to log files to potentially guide an attacker. Recommendations: For versions 2.24 and prior, update to a version later than 2.24 to resolve the issu...

Arbitrary Code Execution

file is vulnerable to arbitrary code execution. The cdfreadpropertyinfo function in cdf.c does not restrict the number of CDFVECTOR elements, resulting a heap-based buffer overflow 4-byte out-of-bounds write...

OracleVM 3.3 : ipmitool (OVMSA-2020-0012)

The remote OracleVM system is missing necessary patches to address critical security updates : - Backport fix for CVE-2020-5208 - Fix missing return in ipmikontronoemmain - CID1261317 - rebase to latest stable upstream version - resolves: rhbz1253416 - remove the redundant OpenIMPI dependency -...

file security update

5.11-36 - fix out-of-bounds read via a crafted ELF file CVE-2018-10360...

Ansible: two random password lookups in same task return same value

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords a...

March 10, 2020—KB4540689 (OS Build 17134.1365)

None None...

SUSE-SU-2020:0578-1 Security update for yast2-rmt

This update for yast2-rmt to version 1.3.0 fixes the following issues: Security issue fixed: - CVE-2018-20105: Fixed an exposure of the CA private key passphrase in the log file bsc1119835. Non-security issue fixed: - Add support for forwarding registration data from RMT to SCC...

CVE-2014-0241

CVE-2014-0241 concerns rubygem-hammer_cli_foreman where the file /etc/hammer/cli.modules.d/foreman.yml is world-readable, enabling a local user to read potentially sensitive configuration data (e.g., usernames or passwords) as the underlying issue. Public sources in the provided documents corrobo...

openSUSE Security Update : nfs-utils (openSUSE-2019-2435)

This update for nfs-utils fixes the following issues : - CVE-2019-3689: Fixed root-owned files stored in insecure /var/lib/nfs. bsc1150733 This update was imported from the SUSE:SLE-15-SP1:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plug...