undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass

A flaw was found in Undertow, where the servlet container causes the servletPath to normalize incorrectly by truncating the path after the semicolon. The flaw may lead to application mapping, resulting in a security bypass...

Unspecified Vulnerability in Samsung Mobile Devices (CNVD-2020-32790)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices have a security vulnerability that can be exploited by attackers to perform arbitrary memory mapping...

CVE-2020-13831

An issue was discovered on Samsung mobile devices with O8.x and P9.0 Exynos 7570 chipsets software. The Trustonic Kinibi component allows arbitrary memory mapping. The Samsung ID is SVE-2019-16665 June 2020...

CVE-2020-13831

An issue was discovered on Samsung mobile devices with O8.x and P9.0 Exynos 7570 chipsets software. The Trustonic Kinibi component allows arbitrary memory mapping. The Samsung ID is SVE-2019-16665 June 2020...

Code injection

An issue was discovered on Samsung mobile devices with O8.x and P9.0 Exynos 7570 chipsets software. The Trustonic Kinibi component allows arbitrary memory mapping. The Samsung ID is SVE-2019-16665 June 2020...

CVE-2020-13831

CVE-2020-13831 affects Samsung mobile devices running O(8.x) and P(9.0) on Exynos 7570. The vulnerability stems from the Trustonic Kinibi component, which allows arbitrary memory mapping. This yields high-severity impact (partial confidentiality, integrity, and availability; in NVD, CVSSv3.1 base...

SUSE-SU-2020:1538-1 Security update for qemu

This update for qemu fixes the following issues: Security issues fixed: - CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code bsc1166240. - CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation bsc1146873. - CVE-2020-1983: Fixed a use-after-free in the ipreas...

CVE-2020-3680

A race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8053, MSM8909W, MSM8917, MSM8953, QCS605, QM215, SA415M, SDM429, SDM429W, SDM439...

Race condition

A race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8053, MSM8909W, MSM8917, MSM8953, QCS605, QM215, SA415M, SDM429, SDM429W, SDM439...

CVE-2020-3680

CVE-2020-3680 describes a race condition in the fastrpc memory mapping API that affects Qualcomm Snapdragon platforms (e.g., Snapdragon Auto/Compute/IoT families) including APQ8009, APQ8053, MSM89xx, QCS605, SDM/SMR series, SXR1130, and others. Root cause: race condition within fastrpc mmap handl...

CVE-2020-3680

A race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8053, MSM8909W, MSM8917, MSM8953, QCS605, QM215, SA415M, SDM429, SDM429W, SDM439...

UPDATE: Infection Monkey 1.8.0

Infection Monkey 1.8.0 was released a while ago. My first post about this tool can be found in a post titled the List of Adversary Emulation Tools. This is a big, exciting release, which enhances the Monkey’s capabilities. The Monkey now maps its actions to the MITRE ATT knowledge base and as...

undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass

A flaw was found in Undertow, where the servlet container causes the servletPath to normalize incorrectly by truncating the path after the semicolon. The flaw may lead to application mapping, resulting in a security bypass...

hibernate: SQL injection issue in Hibernate ORM

A flaw was found in Hibernate ORM. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further...

undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass

A flaw was found in Undertow, where the servlet container causes the servletPath to normalize incorrectly by truncating the path after the semicolon. The flaw may lead to application mapping, resulting in a security bypass...

undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass

A flaw was found in Undertow, where the servlet container causes the servletPath to normalize incorrectly by truncating the path after the semicolon. The flaw may lead to application mapping, resulting in a security bypass...

undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass

A flaw was found in Undertow, where the servlet container causes the servletPath to normalize incorrectly by truncating the path after the semicolon. The flaw may lead to application mapping, resulting in a security bypass...

undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass

A flaw was found in Undertow, where the servlet container causes the servletPath to normalize incorrectly by truncating the path after the semicolon. The flaw may lead to application mapping, resulting in a security bypass...

CVE-2020-12446

The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical memory, reading and writing to Model Specific Register MSR registers, and input from and output to I/O ports to local non-privileged users. This leads to privilege escalation to NT...

Security update for vlc (moderate)

openSUSE Security Update: Security update for vlc Announcement ID: openSUSE-SU-2020:0562-1 Rating: moderate References: 1142161 1146428 Cross-References: CVE-2019-13602 CVE-2019-13962 CVE-2019-14437 CVE-2019-14438 CVE-2019-14498 CVE-2019-14533 CVE-2019-14534 CVE-2019-14535 CVE-2019-14776...