CVE-2020-24027

CVE-2020-24027 concerns a potential buffer overflow in Live Networks, Inc.’s liblivemedia (version 20200625) when handling an RTSP “PLAY” command that specifies seeking by absolute time. The connected sources confirm the affected component and the root cause is a buffer overflow in the RTSP serve...

CVE-2020-24027

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time...

CVE-2020-24027

Removed by vendor...

Stripo Inc: Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/

Summary: I have found a bypass for the report https://hackerone.com/reports/1047119 It seems that a proper fix was not issued therefore the issue still remains. Steps To Reproduce: 1. Create a Plug-In and capture the request. 1. Send this to Intruder 1. Follow the rest in the Video POC. POC Video...

Microsoft Teams < 1.3.0.13000 Remote Code Execution

The version of Microsoft Teams installed on the remote Windows host is a version prior to 1.3.0.13000. It is, therefore, affected by remote code execution vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number....

CVE-2020-25846 CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2

The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential...

CVE-2020-25845 CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1

Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential...

Fedora 33 : mediawiki (2020-0be2d40e13)

https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December /000268.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible witho...

Stripo Inc: Stored XSS in the banner block description

Steps To Reproduce: - Create a new template and add a banner block F1128944 - Add a description to the banner block description: " - Malicious code executed F1128945 Proof Of Concept: F1128942 Impact With this vulnerability, an attacker can for example steal users cookies or redirect users on...

Fedora 32 : phpldapadmin (2020-c6fa47ecd7)

Update to 1.2.6.2 1906752 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 33 : curl (2020-ceaf490686)

curl: Inferior OCSP verification CVE-2020-8286 - libcurl: FTP wildcard stack overflow CVE-2020-8285 - curl: trusting FTP PASV responses CVE-2020-8284 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...

JVN#94169589: Multiple vulnerabilities in GROWI

GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. Denial-of-service DoS due to improper verification of input values CWE-400 - CVE-2020-5682 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L| Base Score: 5.3 CVSS v2|...

Western Digital My Cloud OS 5 Licensing Issue Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital, Inc. An authorization issue vulnerability exists in versions prior to Western Digital My Cloud OS 5.07.118, which could be exploited by attackers to gain access to the device...

Mozilla Firefox < 84.0

The version of Firefox installed on the remote Windows host is prior to 84.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-54 advisory. - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they...

Fedora 33 : 1:nodejs (2020-43d5a372fc)

Update to 14.15.1 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc...

Stripo Inc: Permanent DOS for new users!

Summary: Hi team its me Akash Hamal, and while testing my.stripo.email website which is in scope of your program i was able to DOS permanently any new mail,user which might use your service in future but they won't be able to use ! While registration on my.stripo.email there are three fields...

SUSE SLED15 / SLES15 Security Update : krb5 (SUSE-SU-2020:3377-1)

This update for krb5 fixes the following security issue : CVE-2020-28196: Fixed an unbounded recursion via an ASN.1-encoded Kerberos message bsc1178512. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted...

SUSE SLES15 Security Update : krb5 (SUSE-SU-2020:3375-1)

This update for krb5 fixes the following security issue : CVE-2020-28196: Fixed an unbounded recursion via an ASN.1-encoded Kerberos message bsc1178512. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted...

Fedora 32 : resteasy (2020-239503f5fa)

Security fix for CVE-2020-1695 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 33 : resteasy (2020-df970da9fc)

Security fix for CVE-2020-1695 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...