PT-2020-17954

Name of the Vulnerable Software and Affected Versions IBM i2 Intelligent Analyis Platform version 9.2.1 Description The issue is caused by a memory corruption, allowing a local attacker to execute arbitrary code on the system. This can be achieved by persuading a victim to open a specially-crafte...

CVE-2020-4263: Out-of-bounds Write

IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force...

CVE-2020-4257: Out-of-bounds Write

IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force...

curl: Curl_auth_create_plain_message integer overflow leads to heap buffer overflow

Summary: There is an incorrect integer overflow check in Curlauthcreateplainmessage in lib/vauth/cleartext.c , leading to a potential heap buffer overflow of controlled length and data. The exploitation seems quite easy, yet the vulnerability can only be triggered locally and does not seem to lea...

Linux kernel buffer overflow vulnerability (CNVD-2020-37938)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A buffer overflow vulnerability exists in the 'xdpumemre' function of the net/xdp/xdpumem.c file in versions of Linux kernel prior to 5.6.7, which can be exploited by ...

PT-2020-2709

Name of the Vulnerable Software and Affected Versions NGINX Controller versions 3.1.0 through 3.3.0 Description The issue is related to a buffer overflow in memory, which can allow an attacker to execute arbitrary code. On the local system, processes or users can write arbitrary data into the...

Oracle Database 11g Release 2 - (OracleDBConsoleorcl) Unquoted Service Path Vulnerability

Exploit Title: Oracle Database 11g Release 2 - 'OracleDBConsoleorcl' Unquoted Service Path Discovery by: Nguyen Khang - SunCSR Vendor Homepage: https://www.oracle.com/ Software Link: https://www.oracle.com/database/technologies/112010-win64soft.html Tested Version: 11g release 2 Vulnerability Typ...

CVE-2020-7135

A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant SPP releases 2018.06.0, 2018.09.0, and...

HPESBHF03945 rev.1 - HPE Servers using Supplemental Update / Online ROM Flash Component for Linux, Local Execution of Arbitrary Code.

Potential Security Impact: Local: Execution of Arbitrary Code With Privilege Elevation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Service Pack for ProLiant 2018.06.0, 2018.09.0, 2018.11.0 - Only applies to Linux firmware installer HPE SATA Read Intensive Solid State Drive...

Plex Media Server < 1.19.2.2673 Local Code Execution Vulnerability

Plex Media Server is prone to a local unauthenticated code execution vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

CVE-2020-7275

Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security ENS for Windows Prior to 10.7.0 April 2020 Update allows local users to execute arbitrary code via a carefully crafted input file...

CVE-2020-7275

Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security ENS for Windows Prior to 10.7.0 April 2020 Update allows local users to execute arbitrary code via a carefully crafted input file...

CVE-2018-1000622

The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the...

HPESBHF03994 rev.1 - HPE Superdome Flex with iLO4, Remote or Local Code Execution

Potential Security Impact: Local: Code Execution; Remote: Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP Superdome X Base Enclosure prior to 8.8.16 HPE Integrity Superdome X Server prior to 8.8.16 HPE Integrity Superdome X with BL920s Blades prior to 8.8.16 HPE...

OpenSSH 7.7 - 7.9, 8.x < 8.1 Integer Overflow Vulnerability

OpenSSH is prone to an integer overflow vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openbsd:openssh";...

Parallels Desktop xHCI Component Input Validation Error Vulnerability

Corel Parallels Desktop is a suite of virtual machine software for the macOS platform from Corel Canada. An input validation error vulnerability exists in the xHCI component of Corel Parallels Desktop version 15.1.2-47123, which stems from the program not properly validating user-submitted data. ...

SUSE-SU-2020:14290-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox was updated to version 68.5.0 ESR bsc1163368. Security issues fixed: - CVE-2020-6796: Fixed a missing bounds check on shared memory in the parent process bsc1163368. - CVE-2020-6798: Fixed a JavaScript code injection issue caused ...

PT-2020-8035

Name of the Vulnerable Software and Affected Versions: Curl versions prior to 7.49.1 Apple OS X versions prior to 10.12 Description: The issue allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions,...

IBM DB2 Buffer Overflow Vulnerability (CNVD-2020-10506)

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. A buffer overflow vulnerability exists in IBM DB2 including DB2 Connect Server that originates from th...

OPENSUSE-SU-2020:0209-1 Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues: Security issue fixed: - CVE-2020-0569: Fixed a potential local code execution by loading plugins from CWD bsc1161167. Other issue fixed: - Fixed comboboxes not showing in correct location bsc1158667. This update was imported from the...