[ASA-202009-4] python-django: multiple issues

Arch Linux Security Advisory ASA-202009-4 ========================================= Severity: Medium Date : 2020-09-03 CVE-ID : CVE-2020-24583 CVE-2020-24584 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1217 Summary ======= The package...

Oracle WebLogic Server Insecure Deserialization (CVE-2020-14625)

An insecure deserialization vulnerability exists in Oracle Weblogic. This vulnerability is due to insufficient validation of T3 and IIOP requests...

CVE-2020-11797

An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an unauthenticated attacker to gain access to unauthorized information due to insufficient access validation. A successful exploit...

Authentication flaw

An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an unauthenticated attacker to gain access to unauthorized information due to insufficient access validation. A successful exploit...

CVE-2020-3496

A vulnerability in the IPv6 packet processing engine of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient validation of incoming IPv6 traffic. A...

Path traversal

A vulnerability in a specific REST API method of Cisco Data Center Network Manager DCNM Software could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the API. An attack...

CVE-2020-3519 Cisco Data Center Network Manager Path Traversal Vulnerability

A vulnerability in a specific REST API method of Cisco Data Center Network Manager DCNM Software could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the API. An attack...

Input validation

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected device. To exploit this vulnerability, the attacker would need to have valid...

Insecure Signature Validation

itextsharp does not properly verify the validity of the signature. It was possible to bypass the signature checker due to insufficient validation of PDF document...

CVE-2020-8108 Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759)

Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code into a trusted process. This issue affects: Bitdefender Endpoint Security for Mac versions prior to 4.12.80...

Valve: Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URL

Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URL The vulnerability allowed insufficient validation of parameters, which permitted the injection of shell metacharacters into values used to construct a Bash command...

Dell iDRAC9 Directory Traversal (DSA-2020-128)

The remote host is running iDRAC9 with a firmware version prior to 4.20.20.20. It is, therefore, affected by a directory traversal vulnerability due to insufficient validation of user input. An authenticated, remote attacker can exploit this, by sending a URI that contains directory traversal...

Debian DLA-2298-1 : libapache2-mod-auth-openidc security update

Several issues have been found in libapache2-mod-auth-openidc, the OpenID Connect authentication module for the Apache HTTP server. CVE-2019-14857 Insufficient validation of URLs leads to an Open Redirect vulnerability. An attacker may trick a victim into providing credentials for an OpenID...

[SECURITY] [DLA 2298-1] libapache2-mod-auth-openidc security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2298-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz July 29, 2020 https://wiki.debian.org/LTS -...

Quiz And Survey Master < 7.0.0 - Authenticated Stored Cross-Site Scripting (XSS)

A stored cross-site scripting vulnerability exists in Quiz and Survey Master plugin version 6.4.12 & below. The vulnerability exists in quiz creation module where a user with low privileges is allowed to execute arbitrary script code within the context of the application. This vulnerability is du...

Oracle WebLogic Insecure Deserialization (CVE-2020-2963)

An insecure deserialization vulnerability exists in Oracle Weblogic. This vulnerability is due to insufficient validation of T3 requests...

CVE-2020-15899

Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble...

CVE-2020-9101

There is an out-of-bounds write vulnerability in some products. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets, which may be exploited to cause the process reboot. Affected...

Cross site scripting

There is an out-of-bounds write vulnerability in some products. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets, which may be exploited to cause the process reboot. Affected...

CVE-2020-9101

There is an out-of-bounds write vulnerability in some products. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets, which may be exploited to cause the process reboot. Affected...