OPENSUSE-SU-2020:0703-1 Security update for ant

This update for ant fixes the following issues: Security issue fixed: - CVE-2018-10886: Fixed a path traversal vulnerability in malformed zip file paths, which allowed arbitrary file writes and could potentially lead to code execution bsc1100053. Non-security issues fixed: - Add rhino to the...

SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:1289-1)

This update for libvirt fixes the following issues : Security issue fixed : CVE-2020-10703: Fixed a daemon crash caused by pools without target paths bsc1168683. Non-security issues fixed : apparmor: avoid copying empty profile name bsc1149100. logging: ensure virtlogd rollover takes priority ove...

CVE-2020-9045

CVE-2020-9045 affects Software House C•CURE 9000 v2.70 and American Dynamics victor VMS v5.2. During installation or upgrade, the credentials of the user performing the process are logged to an install log file, which persists after installation. Publicly documented mitigations include upgrading ...

SUSE-SU-2020:1351-1 Security update for ant

This update for ant fixes the following issues: Security issue fixed: - CVE-2018-10886: Fixed a path traversal vulnerability in malformed zip file paths, which allowed arbitrary file writes and could potentially lead to code execution bsc1100053. Non-security issues fixed: - Add rhino to the...

Wowza Media Systems Streaming Engine Arbitrary File Download Vulnerability

Wowza Media Systems Streaming Engine is a suite of streaming media server software from Wowza Media Systems in the United States. A security vulnerability exists in the download logging feature in Wowza Media Systems Streaming Engine 4.x.x and prior versions. An attacker can exploit the...

Cisco Webex Teams Logging Feature Command Execution Vulnerability

According to its self-reported version, Cisco Webex Teams client for Windows is affected by a command execution vulnerability due to improper restrictions on software logging features. An unauthenticated, remote attacker could exploit this vulnerability by convincing a targeted user to visit a...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

SUSE-SU-2020:1289-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issue fixed: - CVE-2020-10703: Fixed a daemon crash caused by pools without target paths bsc1168683. Non-security issues fixed: - apparmor: avoid copying empty profile name bsc1149100. - logging: ensure virtlogd rollover takes priority...

The vulnerability of the VPN System Logging function in Cisco Firepower Threat Defense’s microprogramming-based network interface devices allows a intruder to trigger a service failure.

The vulnerability of the VPN System Logging function in Cisco Firepower Threat Defense FTD microprogramming systems is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

SUSE SLES15 Security Update : libvirt (SUSE-SU-2020:1250-1)

This update for libvirt fixes the following issues : Security issue fixed : CVE-2020-10703: Fixed a daemon crash caused by pools without target paths bsc1168683. Non-security issues fixed : apparmor: avoid copying empty profile name bsc1149100. logging: ensure virtlogd rollover takes priority ove...

CVE-2020-2004

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...

CVE-2020-2004

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...

Design/Logic Flaw

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...

CVE-2020-2004

The CVE-2020-2004 entry affects Palo Alto Networks GlobalProtect App prior to 5.0.9 (and 5.1 prior to 5.1.2 on Windows/macOS). The root cause is that, under specific conditions, a user’s password can be logged in cleartext in PanGPS.log when troubleshooting logs are collected (Save User Credentia...

GlobalProtect App: Passwords may be logged in clear text while collecting troubleshooting logs

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...

Code injection

It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered...

CVE-2020-11932 Subiquity server installer logged LUKS full disk encryption password

It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered...

Information Disclosure

KeyCloak is vulnerable to information disclosure. The vulnerability exists as it logs the password whenever an exception occurs in HttpMethod class, potentially disclosing the password in log files...

SUSE-SU-2020:1250-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issue fixed: - CVE-2020-10703: Fixed a daemon crash caused by pools without target paths bsc1168683. Non-security issues fixed: - apparmor: avoid copying empty profile name bsc1149100. - logging: ensure virtlogd rollover takes priority...

Cisco Firepower Threat Defense Resource Management Error Vulnerability (CNVD-2020-27775)

Cisco Firepower Threat Defense FTD is a suite of unified software from the U.S. company Cisco Cisco that provides next-generation firewall services. A resource management error vulnerability exists in the VPN System Logging feature of Cisco FTD Software, which arises from the program not properly...