Debian DLA-2113-1 : cloud-init security update

CVE-2020-8631 In cloud-init, relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because randstr in cloudinit/util.py calls the random.choice function. CVE-2020-8632 In cloud-init, randuserpassword in cloudinit/config/ccsetpasswords.py has a...

CVE-2020-8632

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...

CVE-2020-8632

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...

Code injection

Bulb Security Smartphone Pentest Framework SPF before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to 1 remoteAttack.pl or 2 guessPassword.pl in frameworkgui/; the filename parameter to 3 CSAttack.pl or 4 SEAttack.pl in...

Design/Logic Flaw

There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote attacker can guess information by a large number of attempts. Successful exploitation may cause information leak...

CVE-2019-15987

CVE-2019-15987 affects Cisco Webex Centers suite (Webex Event Center, Meeting Center, Support Center, Training Center). Root cause: missing CAPTCHA on select URLs allows unauthenticated, remote attacker to enumerate usernames and potentially obtain real names. Impact is information disclosure (no...

CVE-2019-4411

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658...

CVE-2019-0195

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbo...

Design/Logic Flaw

DISPUTED GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthreadcreated thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability."...

CVE-2019-1010025: Use of Insufficiently Random Values

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthreadcreated thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability...

PT-2019-3125

Name of the Vulnerable Software and Affected Versions ТрастМед:Лекарственное обеспечение affected versions not specified Description The issue is related to insufficient limitations on the number of authorization attempts, allowing a remote attacker to guess a user's password. Recommendations At...

CVE-2018-14867

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters...

Improper access control

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters...

CVE-2018-14867

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters...

PT-2019-9065

Name of the Vulnerable Software and Affected Versions Odoo Community versions 9.0 through 10.0 Odoo Enterprise versions 9.0 through 10.0 Description The issue is related to incorrect access control in the portal messaging system, allowing remote attackers to post messages on behalf of customers a...

CVE-2018-14867: Improper Access Control

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters...

CVE-2019-12564

In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sql filenames...

PT-2019-2505

Name of the Vulnerable Software and Affected Versions БАРС.Web-Своды affected versions not specified Description The issue is related to weaknesses in the authorization mechanism of the platform. It can be exploited by a remote attacker using specially crafted POST requests to guess user account...

Information Leakage

The libgcrypt library is vulnerable to information leakage. The vulnerability exists because of a flaw in the libgcrypt PRNG Pseudo-Random Number Generator, leaking the first 580 bytes of the PRNG output which allows the attacker to guess the following 20 bytes...

Malicious Package

text-qrcode package contains malicious code. The randomBytes method is overwritten with a function that generates a weak entropy of 3 bytes and subsequently hashed, which would allow an attacker to guess the random value in a short amount of time...