GNOME security, bug fix, and enhancement update

dleyna-renderer 0.6.0-3 - Add a manual Resolves: 1612579 frei0r-plugins 1.6.1-7 - Rebuild with newer annobin to fix rpmdiff problems - Fix the build with a newer opencv - Resolves: rhbz1703994 gdm 3.28.3-34 - Fix file descriptor leak Resolves: 1877853 3.28.3-33 - Fix problem with Xorg fallback...

libreoffice security, bug fix, and enhancement update

libcmis 0.5.2-1 - Related: rhbz1796893 update to 0.5.2 liborcus 0.14.1-1 - Related: rhbz1796893 update to 0.14.1 libreoffice 6.3.6.2-3.0.1 - Replace colors with Oracle colors Orabug: 32120093 - Build with --with-vendor='Oracle America, Inc.' - Added the --with-hamcrest option to configure...

Linux: noexec option on /tmp

The noexec mount option specifies that the filesystem cannot contain executable binaries. Since the /tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /tmp. SPDX-FileCopyrightText: 2020 Greenbone AG Some text...

The vulnerability of the dccp_printOption() function in the tcpdump utility for capturing and analyzing network traffic allows a hacker to induce a service failure.

The vulnerability of the dccpprintOption function print-dccp.c in the packet capture and analysis tool tcpdump is related to buffer-over-read operations in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

tcpdump: Out of bounds read/write in in get_next_file() in tcpdump.c

An out-of-bounds write vulnerability was discovered in tcpdump while reading the file passed to the -V option of the command line program. An attacker may abuse this flaw by tricking a victim user into using a malicious file with the -V option, which would make the program read one byte before a...

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data coruption

An out-of-bounds OOB memory access flaw was found in the Network XDP the eXpress Data Path module in the Linux kernel's xdpumemreg function in net/xdp/xdpumem.c. When a user with special user privilege of CAPNETADMIN or root calls setsockopt to register umem ring on XDP socket, passing the headro...

kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c

An out-of-bounds write flaw was found in the Linux kernel. An empty nodelist in mempolicy.c is mishandled durig mount option parsing leading to a stack-based out-of-bounds write. The highest threat from this vulnerability is to system availability...

kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c

An out-of-bounds write flaw was found in the Linux kernel. An empty nodelist in mempolicy.c is mishandled durig mount option parsing leading to a stack-based out-of-bounds write. The highest threat from this vulnerability is to system availability...

Linux: noexec option on /var/tmp

The noexec mount option specifies that the filesystem cannot contain special devices. Since the /var/tmp filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create block or character special devices in /var/tmp. SPDX-FileCopyrightText: 2020...

OPENSUSE-SU-2020:1825-1 Security update for pacemaker

This update for pacemaker fixes the following issues: - executor: restrict certain IPC requests to Pacemaker daemons CVE-2020-25654, bsc1177916 - extra: add vim modelines to agents - extra: quote shell variables in agent code where appropriate bsc1175557 - extra: remove trailing whitespace from...

The vulnerability of the jQuery library arises from insufficient cleaning of data provided by users when elements of the <option> type are passed. This allows attackers to perform cross-site scripting attacks.

The vulnerability of the jQuery library exists due to insufficient cleaning of the data provided by the user when elements with the tag are passed to jQuery’s DOM methods. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

accel-mma84 (>=0.2.0 <=0.2.0-beta.3), bus (>=0.2.0 <=2.2.3) +14 more potentially affected by CVE-2020-36219 via atomic-option (=0.1.2)

atomic-option CARGO version =0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on atomic-option and may be impacted: - accel-mma84 =0.2.0, =0.2.0, =0.0.1, =0.7.0, =0.2.5, =1.0.0, =0.3.0, =0.1.0, =0.3.0 and more Source cves: CVE-2020-36219 Source...

Exploit for OS Command Injection in Oscommerce

PoC exploit for CVE-2020-27976, an authenticated remote code exe...

Prototype Pollution

chart.js is vulnerable to prototype pollution. The vulnerability exists through the lack of sanitization of the options parameter, allowing an attacker to inject and overwrite arbitrary properties...

CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting

Exploit Title: CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting Date: 30/10/2020 Exploit Author: Vyshnav NK Vendor Homepage: https://projectworlds.in/ Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip Version: 1.0 Tested on: Window...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...

pro-option.proiwebsites.com Cross Site Scripting vulnerability OBB-1420246

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-1661

On Juniper Networks Junos OS devices configured as a DHCP forwarder, the Juniper Networks Dynamic Host Configuration Protocol Daemon jdhcp process might crash when receiving a malformed DHCP packet. This issue only affects devices configured as DHCP forwarder with forward-only option, that forwar...