CVE-2020-24916

CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...

CVE-2020-24916: Improper Neutralization of Special Elements used in an OS Command

CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection...

PT-2020-16216

Name of the Vulnerable Software and Affected Versions sized-chunks crate versions through 0.6.2 Description An issue in the sized-chunks crate for Rust can lead to memory-safety problems. Specifically, in the Chunk implementation, the array size is not checked when constructed with unit, pair, or...

Fedora 31 : 1:dovecot (2020-cd8b8f887b)

CVE-2020-12100: Parsing mails with a large number of MIME parts could have resulted in excessive CPU usage or a crash due to running out of stack memory. CVE-2020-12673: Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can le...

CVE-2020-10720

A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with local access to crash the system...

Cross-Site Scripting in eco

All versions of eco are vulnerable to Cross-Site Scripting XSS. The package's default escape implementation fails to escape single quotes, which may allow attackers to execute arbitrary JavaScript on the victim's browser. Recommendation No fix is currently available. Consider using an alternative...

Important: Red Hat Security Advisory: dovecot security update

An update for dovecot is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

RHEL 7 : dovecot (RHSA-2020:3617)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3617 advisory. Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3...

PT-2020-21476

Name of the Vulnerable Software and Affected Versions eco versions all Description The issue concerns Cross-Site Scripting XSS due to the package's default escape implementation failing to properly escape single quotes. This failure may allow attackers to execute arbitrary JavaScript on the...

Go CGI / FastCGI Transport Cross Site Scripting

Advisory: Inconsistent Behavior of Go's CGI and FastCGI Transport May Lead to Cross-Site Scripting The CGI and FastCGI implementations in the Go standard library behave differently from the HTTP server implementation when serving content. In contrast to the documented behavior, they may return...

CVE-2020-14381

A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as...

[SECURITY] Fedora 32 Update: eclipse-ecf-3.14.8-4.fc32

ECF is a set of frameworks for building communications into applications and services. It provides a lightweight, modular, transport-independent, fully compliant implementation of the OSGi Remote Services standard...

CVE-2020-3394 Cisco Nexus 3000 and 9000 Series Switches Privilege Escalation Vulnerability

A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to issue the enable command and get full administrative privileges. To exploit this vulnerability, the attack...

Local Administrator Password Solution (LAPS) 導入ガイド (日本語版)

Active Directory 管理者のみなさん、Local Administrator Password Solution LAPS ツールはご存じですか? LAPS ツールは、Active Directory AD に参加して...

RHEL 6 : chromium-browser (RHSA-2020:3560)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3560 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 84.0.4147.135. Security Fixes:...

CVE-2020-24613

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAITCERTCR state, within SanityCheckTls13MsgReceived in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-4467-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4467-1 advisory. Ziming Zhang and VictorV discovered that the QEMU SLiRP networking implementation incorrectly handled replying to certain ICMP ec...

SUSE-SU-2020:2274-1 Security update for dovecot22

This update for dovecot22 fixes the following issues: - CVE-2020-12673: improper implementation of NTLM does not check message buffer size bsc1174922. - CVE-2020-12674: improper implementation of RPA mechanism bsc1174923...

Updated libx11 packages fix security vulnerability

The X Input Method XIM client implementation in libX11 has some integer overflows and signed/unsigned comparison issues that can lead to heap corruption when handling malformed messages from an input method CVE-2020-14344. The libx11 package has been updated to version 1.6.10 which fixes this...

MGASA-2020-0330 Updated dovecot packages fix security vulnerability

CVE-2020-12100: Receiving mail with deeply nested MIME parts leads to resource exhaustion as Dovecot attempts to parse it. CVE-2020-12673: Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash. CVE-2020-12674:...