6506 matches found
USN-4489-1: Linux kernel vulnerability | Cloud Foundry
Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description Or Cohen discovered that the AFPACKET implementation in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service system cras...
grok:grk_decompress_fuzzer: Heap-use-after-free in grk::TileProcessor::~TileProcessor
Detailed Report: https://oss-fuzz.com/testcase?key=5742937236045824 Project: grok Fuzzing Engine: honggfuzz Fuzz Target: grkdecompressfuzzer Job Type: honggfuzzasangrok Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60d000000d50 Crash State:...
Firefox 81 Release Kills High-Severity Code-Execution Bugs
Mozilla patched high-severity vulnerabilities with the release of Firefox 81 and Firefox ESR 78.3, including several that could be exploited to run arbitrary code. Two severe bugs CVE-2020-15674 and CVE-2020-15673 are errors in the browser’s memory-safety protections, which prevent memory access...
fluent-bit:flb-it-fuzz-msgpack_parse_fuzzer_OSSFUZZ: Heap-buffer-overflow in encoded_to_buf
Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5654071359569920 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-msgpackparsefuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type:...
Stubborn WooCommerce Plugin Bugs Gets Third Patch
E-commerce sites using the WordPress plugin Discount Rules for WooCommerce are being urged to patch two high-severity cross-site scripting flaws that could allow an attacker to hijack a targeted site. Two fixes for the flaws, first available on Aug. 22 and second on Sept. 2, failed to patch the...
ffmpeg:ffmpeg_AV_CODEC_ID_COOK_fuzzer: Heap-buffer-overflow in cook_decode_init
Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5762459498184704 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegAVCODECIDCOOKfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address:...
1CRM 8.6.7 Insecure Direct Object Reference
Security Advisory ARA-2020-005: Insecure Direct Object Reference CVE-2020-15958 Affected Products and Environments Product: 1CRM =8.6.7, confirmed for CRBM System ENT-8.6.5, CRBM System ENT-8.6.6 and Startup+ Edition 8.5.15 Environments: All host environments Security Risk Severity: High CVSS v3:...
gdal:gtiff_fuzzer: Heap-buffer-overflow in Fax3Decode2D
Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5139548596862976 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: gtifffuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x615000000c80 Cra...
php:php-fuzz-execute: Heap-use-after-free in zend_gc_delref
Detailed Report: https://oss-fuzz.com/testcase?key=5725932898484224 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-execute Job Type: honggfuzzasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x6120000145c0 Crash State: zendgcdelref izvalptrdtor...
openexr:openexr_scanlines_fuzzer: Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
Project: https://github.com/AcademySoftwareFoundation/openexr.git Detailed Report: https://oss-fuzz.com/testcase?key=5647879652507648 Project: openexr Fuzzing Engine: honggfuzz Fuzz Target: openexrscanlinesfuzzer Job Type: honggfuzzasanopenexr Platform Id: linux Crash Type: Heap-buffer-overflow...
Vulnerabilities fixed in Microsoft SharePoint
Microsoft is fixing several vulnerabilities in Microsoft SharePoint. A malicious party could potentially exploit the vulnerabilities to execute arbitrary code or to conduct a Cross-Site-Scripting XSS attack. Two of the vulnerabilities in SharePoint can be exploited to execute arbitrary code in th...
AMD Radeon DirectX 11 Driver Vulnerabilities - Lenovo Support US
Lenovo Security Advisory: LEN-42153 Potential Impact: Code execution Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2020-6100, CVE-2020-6101, CVE-2020-6102, CVE-2020-6103 Summary Description: AMD reported potential vulnerabilities in a specific virtual machine VM configuration...
AMD Radeon DirectX 11 Driver Vulnerabilities - Lenovo Support US
No description provided...
Brocade Fabric OS and SANnav Vulnerabilities - Lenovo Support US
Lenovo Security Advisory: LEN-46654 Potential Impact: Privilege escalation, denial of service, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2018-6447, CVE-2018-6448, CVE-2018-6449, CVE-2019-16211, CVE-2019-16212, CVE-2020-15369, CVE-2020-15370,...
Intel AMT and Intel ISM Advisory - Lenovo Support US
No description provided...
Intel AMT and Intel ISM Advisory - Lenovo Support US
Lenovo Security Advisory: LEN-41856 Potential Impact: Privilege escalation Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2020-8758 Summary Description: Intel reported potential security vulnerabilities in Intel Active Management Technology AMT and Intel Standard Manageability...
Intel BIOS Advisory - Lenovo Support US
Lenovo Security Advisory: LEN-37550 Potential Impact: Escalation of Privilege, Denial of Service, Information Disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2019-14556, CVE-2019-14557, CVE-2019-14558, CVE-2020-8671, CVE-2020-8672, CVE-2020-0571, CVE-2020-24457 Summar...
Intel BIOS Advisory - Lenovo Support US
No description provided...
Cross-site Scripting (XSS) - Stored in arachnys/cabot
Description Executed Persistent stored XSS in cabot check settings, as well as the address field. As per CVEs present Stored XSS is a High Severity bug. Proof of Concept 1. setup cabot to reproduce the vulnerability 2. create an account now login to the account 3. Go to checks Create and navigate...
Cisco Issues Warning Over IOS XR Zero-Day Flaw Being Targeted in the Wild
Cisco has warned of an active zero-day vulnerability in its router software that's being exploited in the wild and could allow a remote, authenticated attacker to carry out memory exhaustion attacks on an affected device. "An attacker could exploit these vulnerabilities by sending crafted IGMP...