SUSE-SU-2020:2158-1 Security update for xen

This update for xen fixes the following issues: - bsc1174543 - secure boot related fixes - bsc1172356 - Not able to hot-plug NIC via virt-manager, asks to attach on next reboot while it should be live attached...

NETGEAR R6700 Buffer Overflow Vulnerability (CNVD-2020-45110)

The NETGEAR R6700 is a wireless router from NETGEAR. A buffer overflow vulnerability exists in the UPnP service in the NETGEAR R6700 version V1.0.4.8410.0.58, which stems from the program failing to properly validate the length of user-submitted data before copying it to a fixed stack-based buffe...

NETGEAR R6700 Code Issue Vulnerability

The NETGEAR R6700 is a wireless router from NETGEAR. A code issue vulnerability exists in the UPnP service in the NETGEAR R6700 version V1.0.4.8410.0.58. The vulnerability stems from an improper design or implementation during code development of a network system or product. An attacker could...

The vulnerability of the UPnP Device Host service for Windows operating systems allows attackers to increase their privileges.

The vulnerability of the UPnP Device Host service for Windows operating systems is related to incorrect handling of objects in memory. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

CVE-2020-15893

An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play UPnP is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target ST field of the SSDP M-SEARCH discover packet...

PT-2020-5981 · D Link · D-Link Dir-816L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816L versions 2.x before 1.10b04Beta02 Description: An issue exists in the Universal Plug and Play UPnP component of the D-Link DIR-816L device, where UPnP is enabled by default on port 1900. This allows an attacker to perform...

Microsoft Windows UPnP Device Host Elevation of Privilege Vulnerability

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows UPnP Device Host, whic...

Microsoft Windows UPnP Elevation of Privilege Vulnerability

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows UPnP, which arises fro...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2020-41752)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: Audit Plug-in component of MySQL Server 8.0.20 and earlier versions of Oracle MySQL. An attacker can...

UBUNTU-CVE-2020-14591

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Audit Plug-in. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2020-14591

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Audit Plug-in. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2020-14591

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Audit Plug-in. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2020-14591: Undefined Security Weakness

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Audit Plug-in. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2020-1354

An elevation of privilege vulnerability exists when the Windows UPnP Device Host improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows UPnP Device Host Elevation of Privilege Vulnerability'. This CVE ID is unique...

Citrix Bugs Allow Unauthenticated Code Injection, Data Theft

Multiple vulnerabilities in the Citrix Application Delivery Controller ADC and Gateway would allow code injection, information disclosure and denial of service, the networking vendor announced Tuesday. Four of the bugs are exploitable by an unauthenticated, remote attacker. The Citrix products...

SSB-DB Information Disclosure Vulnerability

SSB-DB is a security information storage plug-in. An information disclosure vulnerability exists in SSB-DB version 20.0.0, which stems from the 'get' method that can decrypt any message and can be exploited by an attacker to access private data...

UPnP denial of service vulnerability

UPnP is a Universal Plug and Play protocol from the Open Connectivity Foundation. A security vulnerability exists in versions of UPnP prior to 2020-04-17. An attacker could exploit the vulnerability by sending traffic to an arbitrary location with the help of the SUBSCRIBE feature, resulting in a...

DEBIAN-CVE-2020-13848

Portable UPnP SDK aka libupnp 1.12.1 and earlier allows remote attackers to cause a denial of service crash via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/servicetable/servicetable.c...

Google Faces Privacy Lawsuit Over Tracking Users in Incognito Mode

Google faces a $5 billion class-action lawsuit over claims that it has been collecting people’s browsing information without their knowledge even when using the incognito browsing mode that’s meant to keep their online activities private. The lawsuit, filed in the federal court in San Jose,...

CloudBees Jenkins Self-Organizing Swarm Plug-in Modules Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks.Self-Organizing Swarm Plug-in Modules Plugin is a plug-in that supports the...