CVE-2020-26947: Uncontrolled Search Path Element

monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH with a preference ahead of /usr/lib, which allows local users to gain privileges via a Trojan horse library in the current working directory...

How to Configure an NTP Server on a NetScaler Appliance

This article contains information about configuring a Network Time Protocol NTP server on a NetScaler appliance. Background In the earlier releases of the NetScaler software, you need to manually edit multiple files from the shell prompt of the NetScaler appliance to configure an NTP server. The...

Regular Expression Denial of Service (ReDoS)

Overview dat.gui is an A lightweight graphical user interface for changing variables in JavaScript. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via specially crafted rgb and rgba values. PoC js var gui = new dat.gui.GUI; var Options = function...

Velociraptor - Endpoint Visibility and Collection Tool

Velociraptor is a tool for collecting host based state information using Velocidex Query Language VQL queries. To learn more about Velociraptor, read the documentation on: https://www.velocidex.com/docs/ Quick start If you want to see what Velociraptor is all about simply: 1. Download the binary...

Security update for virtualbox (moderate)

openSUSE Security Update: Security update for virtualbox Announcement ID: openSUSE-SU-2020:1486-1 Rating: moderate References: 1114605 1174075 1174159 1175201 Cross-References: CVE-2020-14628 CVE-2020-14629 CVE-2020-14646 CVE-2020-14647 CVE-2020-14648 CVE-2020-14649 CVE-2020-14650 CVE-2020-14673...

GLSA-202009-04 : Qt GUI: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-202009-04 Qt GUI: Buffer overflow It was discovered that Qt GUIs XBM parser did not properly handle X BitMap files. Impact : Please review the referenced CVE identifiers for details. Workaround : There is no known workaround at th...

Cross site request forgery (csrf)

GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Word document. This is related to QBrush::setMatrix in gui/painting/qbrush.cpp in Qt 4.x...

CVE-2020-25291

GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Word document. This is related to QBrush::setMatrix in gui/painting/qbrush.cpp in Qt 4.x...

Qt GUI: Buffer overflow

Background The GUI module and platform plugins for the Qt5 framework. Description It was discovered that Qt GUI’s XBM parser did not properly handle X BitMap files. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround at this time. Resolution Al...

Citrix ADC/Nestcaler upgrade seems to be stuck when upgrading from GUI

Citrix ADC/Nestcaler upgrade seems to be stuck when upgrading from GUI...

[SECURITY] Fedora 32 Update: eclipse-gef-3.11.0-13.fc32

The Graphical Editing Framework GEF allows developers to create a rich graphical editor from an existing application model. GEF is completely application neutral and provides the groundwork to build almost any application, including but not limited to: activity diagrams, GUI builders, class diagr...

FreeBSD : ark -- extraction outside of extraction directory (38fdf07b-e8ec-11ea-8bbe-e0d55e2a8bf9)

Albert Astals Cid reports : Overview A maliciously crafted TAR archive containing symlink entries would install files anywhere in the user's home directory upon extraction. Proof of concept For testing, an example of malicious archive can be found at dirsymlink.tar Impact Users can unwillingly...

ark -- extraction outside of extraction directory

Albert Astals Cid reports: Overview A maliciously crafted TAR archive containing symlink entries would install files anywhere in the user's home directory upon extraction. Proof of concept For testing, an example of malicious archive can be found at dirsymlink.tar Impact Users can unwillingly...

Security Bulletin: IBM Elastic Storage Server GUI is affected by weak crypto algorithm (CVE-2020-4379)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storager Server GUI. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4379 DESCRIPTION: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms...

Security Bulletin: IBM Elastic Storage Server GUI is affected by verbose error messages being displayed.

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage Server GUI where verbose error messages may be displayed. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4357 DESCRIPTION: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could...

Security Bulletin: IBM Elastic Storage Server GUI is affected by weak cryptographic algorithms

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage Server GUI where weaker than desirable cryptographic algorithms are permitted. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4350 DESCRIPTION: IBM Spectrum Scale 5.0.0.0...

CVE-2020-4381

IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific services are enabled. IBM X-Force ID: 179162...

CVE-2020-4381

IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific services are enabled. IBM X-Force ID: 179162...

CVE-2020-4381

IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific services are enabled. IBM X-Force ID: 179162...

CVE-2020-4381: Undefined Security Weakness

IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific services are enabled. IBM X-Force ID: 179162...