421 matches found
UBUNTU-CVE-2020-28035
WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC...
CVE-2020-5938
On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length than the BIG-IP configuration would otherwise allow...
PT-2020-4460 · Cisco · Cisco Ftd +1
Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions prior to the fixed version Cisco Firepower Threat Defense FTD Software versions prior to the fixed version Description: A vulnerability in the OSPF Version 2 OSPFv2 implementation could...
CVE-2020-16896 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
...
The vulnerability in the implementation of the NetBIOS protocol on Windows operating systems allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the NetBIOS protocol implementation in Windows operating systems is related to errors in object memory handling. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
OPENSUSE-SU-2020:1232-1 Security update for knot
This update for knot fixes the following issues: - CVE-2017-11104: Fixed an improper implementation of TSIG protocol which could have allowed an attacker with a valid key name and algorithm to bypass TSIG authentication boo1047841. This update was imported from the openSUSE:Leap:15.2:Update updat...
USN-4451-2 ppp vulnerability
USN-4451-1 fixed a vulnerability in ppp. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Thomas Chauchefoin working with Trend Micro´s Zero Day Initiative, discovered that ppp incorrectly handled module loading. A local attacker...
CVE-2020-2973
Vulnerability in the Oracle Application Express component of Oracle Database Server. Supported versions that are affected are 5.1-19.2. Easily exploitable vulnerability allows low privileged attacker having SQL Workshop privilege with network access via HTTP to compromise Oracle Application...
PT-2020-6383 · F5 · Big-Ip
Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 12.1.0 through 12.1.5.1 F5 BIG-IP versions 13.1.0 through 13.1.3.3 F5 BIG-IP versions 14.1.0 through 14.1.2.5 F5 BIG-IP versions 15.0.0 through 15.1.0.3 Description: The issue is related to a lack of protection for the web...
Treck TCP/IP TCP Component Input Validation Error Vulnerability
Treck TCP/IP is a suite of TCP Transmission Control Protocol/IP Internet Interconnection Protocol from Treck, Inc. dedicated to embedded systems. An input validation error vulnerability exists in the Treck TCP/IP TCP component. The vulnerability arises from a network system or product that does n...
Universal Plug and Play (UPnP) SUBSCRIBE can be abused to send traffic to arbitrary destinations
Overview The Universal Plug and Play UPnP protocol in effect prior to April 17, 2020 can be abused to send traffic to arbitrary destinations using the SUBSCRIBE functionality. Description The UPnP protocol, as specified by the Open Connectivity Foundation OCF, is designed to provide automatic...
HTTP/2: large amount of data requests leads to denial of service
A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a...
MGASA-2020-0168 Updated gnutls packages fix security vulnerability
Updated gnutls packages fix security vulnerability: A flaw was reported in the DTLS protocol implementation in GnuTLS. The DTLS client would not contribute any randomness to the DTLS negotiation, breaking the security guarantees of the DTLS protocol CVE-2020-11501...
The vulnerability of the XMPP protocol implementation in the Cisco Meeting Server conference platform, related to insufficient input data validation, allows a perpetrator to trigger a service failure.
The vulnerability of the XMPP protocol implementation in the Cisco Meeting Server conference platform is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending corrupted authentication requests...
The vulnerability of the Border Gateway Protocol (BGP) implementation in Ethernet VPN technology of the Cisco IOS XR operating system allows a attacker to cause a service failure.
The vulnerability of the Border Gateway Protocol BGP implementation in Ethernet VPN technology of the Cisco IOS XR operating system is related to resource management errors. Exploiting this vulnerability allows a malicious actor to cause service failures through a specially created Multicast Leav...
Information disclosure
Chrony before 1.29.1 has traffic amplification in cmdmon protocol...
CVE-2010-4533
offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies...
CVE-2010-4533
offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies...
Design/Logic Flaw
Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS...
curl: SMB access smuggling via FILE URL on Windows
Summary: While CURL 7.62 parses URLs that have an ? parameter separator char after the fragment separator, CURL urlapi code treats the path with the hash part as it being the same one, this may allow some problem on specific protocols that may have a security impact. On HTTP, an attacker may be...