CVE-2020-7738

All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad...

CVE-2020-7738

CVE-2020-7738 affects the shiba package. The root cause is the use of js-yaml.load() instead of the secure js-yaml.safeLoad(), enabling Arbitrary Code Execution. Affected: all shiba versions; impact: arbitrary code execution; remediation: Snyk notes no fixed shiba version yet. References include ...

kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c

A flaw was found in the Linux kernel’s implementation of dropping sysctl entries. A local attacker who has access to load modules on the system can trigger a condition during module load failure and panic the system...

kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c

A flaw was found in the Linux kernel’s implementation of dropping sysctl entries. A local attacker who has access to load modules on the system can trigger a condition during module load failure and panic the system...

EulerOS Virtualization for ARM 64 3.0.6.0 : perl-Module-Load-Conditional (EulerOS-SA-2020-2013)

According to the version of the perl-Module-Load-Conditional package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - It was found that perl can load modules from the current directory if not found in the module...

EulerOS Virtualization for ARM 64 3.0.6.0 : perl-Sys-Syslog (EulerOS-SA-2020-2039)

According to the version of the perl-Sys-Syslog package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - It was found that perl can load modules from the current directory if not found in the module directories, via th...

Huawei EulerOS: Security Advisory for perl-Module-Load-Conditional (EulerOS-SA-2020-2013)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.6.0 : perl-JSON-PP (EulerOS-SA-2020-2053)

According to the version of the perl-JSON-PP package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - It was found that perl can load modules from the current directory if not found in the module directories, via the...

Updated pdns packages fix security vulnerability

An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while...

MGASA-2020-0375 Updated pdns packages fix security vulnerability

An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while...

NGINX before 1.17.7 with certain error_page configurations allows HTTP request smuggling as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

...

Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values which trigger an out-of-bounds write.

...

CVE-2020-14027

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...

CVE-2020-14027

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...

Code injection

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...

CVE-2020-14027

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...

CVE-2020-14027

CVE-2020-14027 affects Ozeki NG SMS Gateway up to version 4.17.6, where database connection strings accept custom unsafe arguments (e.g., ENABLE_LOCAL_INFILE). This enables MySQL LOAD DATA LOCAL INFILE attacks via rogue servers. The connected sources confirm the vulnerable component as the databa...

Arbitrary Code Execution

Teeworlds is vulnerable to arbitrary code execution. An integer overflow in CMap::Load in engine/shared/map.cpp allows an attacker to execute arbitrary code on the host OS via a buffer overflow from the mishandling of the multiplication of width and height...

Citrix WEM Agents not Synchronizing Error “No Connection Could be Made Because The Target Machine Actively Refused it”

Citrix Virtual Delivery Agents running Workspace Environment Management WEM Agents are not synchronizing with two or more WEM Broker servers load balanced via Citrix Gateway. Policies delivered through WEM are not applying to agents Event Viewer shows the following error:“No connection could be...

Denial Of Service (DoS)

mysql-connector-java is vulnerable to denial of service. When working with a load balancing setup, if the connection property loadBalanceStrategy was set to bestResponseTime and connections to all the hosts in the original setup failed, a denial of service condition will occur in Connector/J, eve...