Security Bulletin: OpenSSH vulnerability affects IBM Spectrum Protect Plus (CVE-2020-15778)

Summary A vulnerability in OpenSSH may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-15778 DESCRIPTION: OpenSSH could allow a remote attacker to execute arbitrary commands on the system, caused by improper input validation in the remote function in scp.c. By using backti...

ICU: Integer overflow in UnicodeString::doAppend()

An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend function in common/unistr.cpp...

openSUSE Security Update : prboom-plus (openSUSE-2020-807)

This update for prboom-plus fixes the following issues : - CVE-2019-20797: Fixed a buffer overflow in client and server code responsible for handling received UDP packets boo1171974 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUS...

Security Bulletin: Vulnerabilities in Faster-XML jackson-databind affect IBM Spectrum Protect Plus (CVE-2020-10673, CVE-2020-1112, CVE-2020-11113, CVE-2020-10672, CVE-2020-10968, CVE-2020-10969, CVE-2020-11619, CVE-2020-11111, CVE-2020-11620)

Summary There are multiple vulnerabilities in FasterXML jackson-databind that may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-10673 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe...

Unspecified Vulnerability in Oracle Hyperion BI+ (CNVD-2020-43723)

Oracle Hyperion BI+ is a business intelligence platform. A security vulnerability exists in Hyperion BI+. An attacker could exploit the vulnerability to gain unauthorized access to data and compromise the confidentiality of the data...

Apple Security Update: iOS 12.4.8

Apple recommends to install security update iOS 12.4.8 on devices iPhone 5s, iPhone 6 and 6 Plus, iPad Air, iPad mini 2 and 3, iPod touch 6th generation...

Apple Security Update: iOS 12.4.8

Apple recommends to install security update iOS 12.4.8 on devices iPhone 5s, iPhone 6 and 6 Plus, iPad Air, iPad mini 2 and 3, iPod touch 6th generation...

Apple Security Update: iOS 12.4.8

Apple recommends to install security update iOS 12.4.8 on devices iPhone 5s, iPhone 6 and 6 Plus, iPad Air, iPad mini 2 and 3, iPod touch 6th generation...

OPENSUSE-SU-2020:0958-1 Security update for hylafax+

This update for hylafax+ fixes the following issues: Security issue fixed: - CVE-2020-8024 boo1172731 hylafax+ was updated to version 7.0.2: change FIXEDWIDTH default to better accommodate auto-rotation 13 Dec 2019 prevent SSLaccept from blocking 5 Dec 2019 support libtiff v4.1 5 Dec 2019 fix...

Huawei ChangXiang 8 Plus Input Validation Error Vulnerability

Huawei ChangXiang 8 Plus is a smartphone from Chinese company Huawei Huawei. A security vulnerability exists in previous versions of Huawei ChangXiang 8 Plus 9.1.0.136 C00E121R1P6T8, which stems from the program failing to properly handle messages from the base station. An attacker could exploit...

CVE-2020-1837

ChangXiang 8 Plus with versions earlier than 9.1.0.136C00E121R1P6T8 have a denial of service vulnerability. The device does not properly handle certain message from base station, the attacker could craft a fake base station to launch the attack. Successful exploit could cause a denial of signal...

CVE-2020-1837

ChangXiang 8 Plus with versions earlier than 9.1.0.136C00E121R1P6T8 have a denial of service vulnerability. The device does not properly handle certain message from base station, the attacker could craft a fake base station to launch the attack. Successful exploit could cause a denial of signal...

Race condition

ChangXiang 8 Plus with versions earlier than 9.1.0.136C00E121R1P6T8 have a denial of service vulnerability. The device does not properly handle certain message from base station, the attacker could craft a fake base station to launch the attack. Successful exploit could cause a denial of signal...

CVE-2020-1837

CVE-2020-1837 affects Huawei ChangXiang 8 Plus devices running versions earlier than 9.1.0.136 (C00E121R1P6T8). The vulnerability stems from improper handling of certain base-station messages, allowing an attacker to impersonate a base station and trigger a denial of service that can cause a deni...

CVE-2020-1837

ChangXiang 8 Plus with versions earlier than 9.1.0.136C00E121R1P6T8 have a denial of service vulnerability. The device does not properly handle certain message from base station, the attacker could craft a fake base station to launch the attack. Successful exploit could cause a denial of signal...

CVE-2020-8188

CVE-2020-8188 relates to UniFi Protect firmware. Multiple sources confirm a privilege-escalation issue where “view only” users could run certain custom commands to assign themselves unauthorized roles, leading to elevated privileges. The vulnerability affects Protect firmware v1.13.2 and v1.14.9 ...

EQDKP Plus CMS 2.3.29 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Reflected Cross-Site Scripting XSS Vulnerability product: EQDKP Plus CMS vulnerable version: = 2.3.29 fixed version: 2.3.30 CVE number: - impact: Low homepage:...

EQDKP Plus CMS 2.3.29 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications ======================================================================= title: Reflected Cross-Site Scripting XSS Vulnerability product: EQDKP Plus CMS vulnerable version: = 2.3.29 fixed version: 2.3.30 CVE number: - impact: Low homepage:...

ALPINE-CVE-2020-15049

An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace...

CVE-2020-7816

A vulnerability in the JPEG image parsing module in DaView Indy, DaVa+, DaOffice softwares could allow an unauthenticated, remote attacker to cause an arbitrary code execution on an affected device.nThe vulnerability is due to a stack overflow read. An attacker could exploit this vulnerability by...