Huawei EulerOS: Security Advisory for screen (EulerOS-SA-2020-1433)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

holz-becker.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1142773 Security Researcher Hchabik Helped patch 2358 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting holz-becker.com website and...

CVE-2020-11647

In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by limiting the amount of recursion...

UBUNTU-CVE-2020-11647

In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by limiting the amount of recursion...

CVE-2020-11647

In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by limiting the amount of recursion...

SQL Injection

python-sqlalchemy is vulnerable to SQL injection. It was discovered that SQLAlchemy did not sanitize values for the limit and offset keywords for SQL select statements. If an application using SQLAlchemy accepted values for these keywords, and did not filter or sanitize them before passing them t...

Denial Of Service (DoS)

php is vulnerable to denial of service DoS. The vulnerability exists as an integer signedness issue was found in the PHP zip extension. An attacker could use a specially-crafted ZIP archive to cause the PHP interpreter to use an excessive amount of CPU time until the script execution time limit i...

Insecure Resource Limit Verification

samba does not properly verify resource limits. It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cif...

The vulnerability of the exif_process_IFDTag function in the PHP programming language allows a perpetrator to gain unauthorized access to information or cause service failures.

The vulnerability of the exifprocessIFDTagName function in the PHP programming language is related to the execution of an operation that exceeds the permissible buffer data limits. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to information or cause servic...

CVE-2019-3882

A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhausti...

ZSQL: Resource Limit of a Single User

Configure the resource limit to enable the maximum number of connections of a single user as defined in ADMPROFILES table. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2020-11650

An issue was discovered in iXsystems FreeNAS and TrueNAS 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent...

CVE-2020-1616

Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Networks Juniper Advanced Threat Prevention JATP Series and Virtual JATP vJATP devices allows an unauthenticated, remote attacker to perform multiple login attempts in excess of th...

CVE-2020-1616 JATP Series: JATP Is susceptible to slow brute force attacks on the SSH service.

Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Networks Juniper Advanced Threat Prevention JATP Series and Virtual JATP vJATP devices allows an unauthenticated, remote attacker to perform multiple login attempts in excess of th...

ZSQL: Maximum Number of Connections

If the maximum number of online connections is set to a large value, the required process socket handles and session pool memory may exceed the OS limit on the server. - Value: The minimum value to be compliant. - Maximum: The maximum value to be compliant. SPDX-FileCopyrightText: 2020 Greenbone ...

Git-Hound v1.1 - GitHound Pinpoints Exposed API Keys On GitHub Using Pattern Matching, Commit History Searching, And A Unique Result Scoring System

A batch-catching, pattern-matching, patch-attacking secret snatcher. GitHound pinpoints exposed API keys and other sensitive information on GitHub using pattern matching, commit history searching, and a unique result scoring system. GitHound has earned me over $7500 applied to Bug Bounty research...

SUSE-SU-2020:0456-1 Security update for java-1_7_1-ibm

This update for java-171-ibm fixes the following issues: Java was updated to 7.1 Service Refresh 4 Fix Pack 60 bsc1162972, bsc1160968. Security issues fixed: - CVE-2020-2583: Fixed a serialization vulnerability in BeanContextSupport bsc1162972. - CVE-2020-2593: Fixed an incorrect check in...

April 7, 2020, update for OneNote 2016 (KB4475586)

None None...

Command Injection

Overview get-git-data is a git repository data in node. Affected versions of this package are vulnerable to Command Injection. The argument limit can be controlled by users without any sanitization PoC var root = require"get-git-data"; root.log"& touch Song"; Details Cross-site scripting or XSS i...

Acronis: Missing rate limit for current password field (Password Change) Account Takeover

Vulnerability: Missing Rate Limit for Current Password field Password Change Account Takeover Steps to reproduce the bug: 1Go to Profile Password. Enter any wrong password In current password filed. 2Now enter the new password and Turn the Intercept ON. 3Capture the request & Send the request to...