Denial Of Service (DoS)

java is vulnerable to denial of service DoS. The vulnerability exists as a null pointer dereference flaw was found in LittleCMS. An application using color profiles could crash while converting a specially-crafted image file...

Arbitrary Code Execution

lcms is vulnerable to arbitrary code execution. The vulnerability exists in the way LittleCMS handled color profiles. An attacker could use these flaws to create a specially-crafted image file which could cause a Java application to crash or, possibly, execute arbitrary code when opened...

Denial Of Service (DoS)

lcms is vulnerable to denial of service DoS. The vulnerability exists as a memory leak flaw was found in LittleCMS embedded in OpenJDK. A application using color profiles could use excessive amounts of memory, and possibly crash after using all available memory, if used to open specially-crafted...

Arbitrary Code Execution

ghostscript is vulnerable to arbitrary code execution. The vulnerability exists as multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in Ghostscript's International Color Consortium Format library...

August 2014 MDM client update in Windows RT 8.1 and Windows 8.1

August 2014 MDM client update in Windows RT 8.1 and Windows 8.1 Symptoms Issue 1 Assume that you install a Windows Store app, such as Microsoft OneNote, through Mobile Device Manager MDM in Windows RT 8.1 or Windows 8.1. In this situation, the app cannot be updated through Windows Store...

ZSQL: Number of Failed Login Attempts

The FAILEDLOGINATTEMPTS parameter specifies the maximum number of login attempts allowed before an account is locked. If the number of an account SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

ZSQL: Password Grace Period

The password grace period is the days between password expiration warning and password expiration. In this grace period, users can change their passwords before password expiration, ensuring service continuity. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted fr...

OPENSUSE-SU-2020:0398-1 Security update for cni, cni-plugins, conmon, fuse-overlayfs, podman

This update for cni, cni-plugins, conmon, fuse-overlayfs, podman fixes the following issues: podman was updated to 1.8.0: - CVE-2019-18466: Fixed a bug where podman cp would improperly copy files on the host when copying a symlink in the container that included a glob operator 3829 bsc1155217 - T...

[ASA-202003-13] bluez: access restriction bypass

Arch Linux Security Advisory ASA-202003-13 ========================================== Severity: High Date : 2020-03-19 CVE-ID : CVE-2020-0556 Package : bluez Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-1116 Summary ======= The package bluez before versi...

SUSE SLES15 Security Update : cni, cni-plugins, conmon, fuse-overlayfs, podman (SUSE-SU-2020:0697-1)

This update for cni, cni-plugins, conmon, fuse-overlayfs, podman fixes the following issues : podman was updated to 1.8.0 : CVE-2019-18466: Fixed a bug where podman cp would improperly copy files on the host when copying a symlink in the container that included a glob operator 3829 bsc1155217 The...

Ships can’t be hacked. Wrong

I get a lot of objections from ships captains when discussing security flaws in ships, so I felt it worthwhile looking at these in some detail. The usual response is ‘ships can’t be hacked.’ When I dig further, what they usually seem to mean is that ‘processes aboard the bridge mean that the...

DRUPAL-CONTRIB-2020-004

The Profile module enables you to allow users to have configurable user profiles. The module doesn't sufficiently check access when creating a user profile. Users with the "create profiles" permission could create profiles for any users...

Hamas Ensnares Israeli Soldiers with Pretty 'Ladies'

Hamas has been caught taking a classic “catfish” approach, to tempt Israeli soldiers into installing spyware on their phones. Members posed as teen girls who are looking for quality chat time. This is the third time that the Palestinian group has used the tactic – but this time it upped its...

Profile - Moderately critical - Access Bypass - SA-CONTRIB-2020-004

The Profile module enables you to allow users to have configurable user profiles. The module doesn't sufficiently check access when creating a user profile. Users with the "create profiles" permission could create profiles for any users...

Logon/Logoff Issues with Citrix Profile Management and Opportunistic Locks (OpLocks)

Slow Logon's Slow Logoff's Sessions never logoff until the Lock is removed Sessions never logon until the Lock is removed Temporary Profiles...

DotNetNuke File Upload Limit Bypass Vulnerability

DotNetNuke CMS referred to as DNN is a free , open source , scalable content management system , is built on the ASP.NET platform Web application framework. DotNetNuke has a security vulnerability. An attacker can upload files with extensions that are only allowed for super users by executing cod...

Collating Hacked Data Sets

Two Harvard undergraduates completed a project where they went out on the dark web and found a bunch of stolen datasets. Then they correlated all the information, and combined it with additional, publicly available, information. No surprise: the result was much more detailed and personal. "What w...

Temporary User Profiles Received Instead of Citrix Profile Management Profiles

Citrix Profile Management has been installed and configured in the environment. A Citrix Profile Management Store has been setup for the users where their profiles should be stored. When a user logs in they are receiving a temporary windows user profile instead of a Citrix Profile Management...

WordPress Ultimate Member Plugin <= 2.1.2 Multiple Insecure Direct Object Reference Vulnerabilities

The WordPress plugin Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2020-6859

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified userid parameter. This is related to ajaximageupload and...