CVE-2020-15168 File size limit bypass in node-fetch

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no...

Oracle Linux 8 : php:7.3 (ELSA-2020-3662)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3662 advisory. php 7.3.20-1 - update to 7.3.20 1856655 php-pear 1:1.10.9-1 - update PEAR to 1.10.9 - update ArchiveTar to 1.4.7 - update ConsoleGetopt to 1.4.2 Tenabl...

CVE-2020-11124

u'Possible use-after-free while accessing diag client map table since list can be reallocated due to exceeding max client limit.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, Nicobar, QCS404,...

Double free

u'Possible use-after-free while accessing diag client map table since list can be reallocated due to exceeding max client limit.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, Nicobar, QCS404,...

EulerOS Virtualization for ARM 64 3.0.2.0 : dbus (EulerOS-SA-2020-1982)

According to the version of the dbus packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - An uncontrolled resource consumption vulnerability was discovered in D-Bus. The DBusServer leaks file descriptors when a...

EulerOS Virtualization for ARM 64 3.0.2.0 : bind (EulerOS-SA-2020-1953)

According to the versions of the bind packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An assertion failure was found in BIND, which checks the validity of messages containing TSIG resource records. This fla...

FreeBSD : Gitlab -- multiple vulnerabilities (1fb13175-ed52-11ea-8b93-001b217b3468)

Gitlab reports : Vendor Cross-Account Assume-Role Attack Stored XSS on the Vulnerability Page Outdated Job Token Can Be Reused to Access Unauthorized Resources File Disclosure Via Workhorse File Upload Bypass Unauthorized Maintainer Can Edit Group Badge Denial of Service Within Wiki Functionality...

Exploit for Deserialization of Untrusted Data in Oracle Access_Manager

This is a Java class file, specifically the Main class from the com.axin package. The class has a single method, main, which takes an array of String arguments. The method is not implemented, as it is empty. The class has several annotations and attributes, including: LineNumberTable: This...

Maximum Lifespan of SSL/TLS Certificates is 398 Days Starting Today

Starting today, the lifespan of new TLS certificates will be limited to 398 days, a little over a year, from the previous maximum certificate lifetime of 27 months 825 days. In a move that's meant to boost security, Apple, Google, and Mozilla are set to reject publicly rooted digital certificates...

CVE-2020-12645

OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...

X (Formerly Twitter): Bypass Password Authentication to Update the Password

Summary:This additional security measure from twitter provides protection to the victim's account, considering that a victim's session may have been hijacked by a hacker, however, due to this additional layer of security Implemented by twitter the hacker would not be able to change the victim's...

Security Bulletin: IBM Resilient users may experience a denial of service of the SOAR Platform due to a insufficient input validation (CVE-2019-4533)

Summary IBM Resilient users may experience a denial of service of the SOAR Platform if a form field contains a extremely large data in a POST, PUT, or PATCH http request. Vulnerability Details CVEID: CVE-2019-4533 DESCRIPTION: IBM Resilient users may experience a denial of service of the SOAR...

Security Bulletin: IBM Resilient users may experience a denial of service of the SOAR Platform due to a insufficient input validation (CVE-2019-4579)

Summary IBM Resilient users may experience a denial of service of the SOAR Platform if a form field contains a extremely large data in a POST, PUT, or PATCH http request. Vulnerability Details CVEID: CVE-2019-4579 DESCRIPTION: IBM Resilient OnPrem uses incomplete blocklisting for input validation...

crosleyrepros.com Cross Site Scripting vulnerability OBB-1273669

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

The vulnerability of the stralloc_readyplus function in the netqmail client’s commands.c file, which allows a hacker to cause a service failure.

The vulnerability of the strallocreadyplus function in the netqmail client’s commands.c file is related to the operation that checks whether the output values are within acceptable buffer data limits. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2020-24345

JerryScript through 2.3.0 allows stack consumption via function anew new Proxya,JSON.parse"",a. NOTE: the vendor states that the problem is the lack of the --stack-limit option...

CVE-2020-24345

JerryScript through 2.3.0 allows stack consumption via function anew new Proxya,JSON.parse"",a. NOTE: the vendor states that the problem is the lack of the --stack-limit option...

Design/Logic Flaw

JerryScript through 2.3.0 allows stack consumption via function anew new Proxya,JSON.parse"",a. NOTE: the vendor states that the problem is the lack of the --stack-limit option...

CVE-2020-24345

JerryScript through 2.3.0 allows stack consumption via function anew new Proxya,JSON.parse"",a. NOTE: the vendor states that the problem is the lack of the --stack-limit option...

CVE-2020-12100

A flaw was found in dovecot. A remote attacker could cause a denial of service by repeatedly sending emails containing MIME parts containing malicious content of which dovecot will attempt to parse. The highest threat from this vulnerability is to system availability. Mitigation Upstream suggests...