Security Bulletin: Vulnerability in InstallShield affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2016-2542)

Summary An InstallShield vulnerability was disclosed by Flexera. InstallShield is used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTION: Flexera...

Design/Logic Flaw

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object...

GraphQL: Security breach on Viewer query

Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...

RHEL 8 : java-11-openjdk (RHSA-2020:2970)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2970 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixe...

CVE-2020-15036

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Linked.php dv parameter...

glpi -- SQL Injection in Search API

MITRE Corporation reports: In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or databa...

RUSTSEC-2020-0026 linked-hash-map creates uninitialized NonNull pointer

Affected versions of this crate called mem::uninitialized to create a NonNull, which is undefined behavior. The flaw was corrected by avoiding the use of mem::uninitialized...

accepted (>=0.1.13, <=0.1.20), actors-rs (>=0.1.0, <=0.1.4) +325 more potentially affected by CVE-2020-25573 via linked-hash-map (>=0.0.9, <=0.4.2)

linked-hash-map CARGO version =0.0.9, =0.1.13, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.5.0, =0.3.1, =0.3.2, =0.1.0, =0.1.0, =0.7.1 and more Source cves: CVE-2020-25573 Source advisory: OSV:RUSTSEC-2020-0026...

linked-hash-map creates uninitialized NonNull pointer

Affected versions of this crate called mem::uninitialized to create a NonNull, which is undefined behavior. The flaw was corrected by avoiding the use of mem::uninitialized...

Trump, Biden Campaign Staffers Targeted By APT Phishing Emails

With the U.S. presidential election months away, advanced persistent threat APT groups are targeting the campaign staffers of both Donald Trump and Joe Biden in recent phishing attacks. On Thursday, Shane Huntley with Google’s Threat Analysis Group said on Twitter that two separate phishing...

CVE-2020-4026

The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are...

Authorization

The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are...

The bundled version of Atlassian Navigator Links contained an incorrect authorization check - CVE-2020-4026

The bundled version of Atlassian Navigator Links plugin in Atlassian Fisheye before version 4.8.2 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check. Additional details about the issue in...

Huawei Data Communication: DoS Vulnerability in Some Huawei Products (huawei-sa-20171206-01-nqa)

Some Huawei products have a DoS vulnerability due to insufficient validation of the Network Quality AnalysisNQA packets. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Denial Of Service (DoS)

The libtiff package is vulnerable to Denial Of Service DoS.Due to integer overflow flaws discovered in libtiff, an attacker can create a specially-crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code...

SUSE-SU-2020:0528-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Java 8.0 was updated to Service Refresh 6 Fix Pack 5 bsc1162972, bsc1160968 - CVE-2020-2583: Unlink Set of LinkedHashSets - CVE-2019-4732: Untrusted DLL search path vulnerability - CVE-2020-2593: Normalize normalization for all -...

MGASA-2020-0128 Updated pure-ftpd packages fix security vulnerabilities

Updated pure-ftpd packages fix security vulnerabilities: An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the lookupaliasconst char alias or printaliasesvoid function is called, they fail to correctly detect...

CVE-2020-9274

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the lookupaliasconst char alias or printaliasesvoid function is called, they fail to correctly detect the end of the linked list and try to access a non-existe...

DEBIAN-CVE-2020-9274

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the lookupaliasconst char alias or printaliasesvoid function is called, they fail to correctly detect the end of the linked list and try to access a non-existe...

Null pointer dereference

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the lookupaliasconst char alias or printaliasesvoid function is called, they fail to correctly detect the end of the linked list and try to access a non-existe...