PT-2020-6983 · Glib +8 · Glib +8

Name of the Vulnerable Software and Affected Versions: glib versions prior to 2.63.6 Description: A flaw was found in glib due to random charset alias, which can cause pkexec to leak content from files owned by privileged users to unprivileged ones under the right condition. This issue is related...

PT-2021-4230 · Linux +7 · Linux Kernel +7

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.4.92 Description: The issue is related to the disclosure of protected information in the Linux kernel, specifically in the BPF protocol. It allows an attacker with a local account to leak information about...

PT-2020-19887 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE version 12.2 Description: The issue concerns insecure permissions in GitLab EE. Recommendations: For GitLab EE version 12.2, update to a version that addresses the insecure permissions issue...

PT-2020-19891 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.4 through 12.7.2 Description: The issue is related to incorrect access control. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents...

PT-2020-2758 · Suse · Crowbar-Core +3

Name of the Vulnerable Software and Affected Versions: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1 SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3 SUSE OpenStack Cloud 9 ardana-ansible versions prior to...

PT-2020-5477

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.4 Description The issue is related to the org.apache.openjpa.ee.WASRegistryManagedRuntime component of the Jackson-databind library, which mishandles the interaction between serialization...

Security update for apt-cacher-ng (important)

openSUSE Security Update: Security update for apt-cacher-ng Announcement ID: openSUSE-SU-2020:0146-1 Rating: important References: 1157703 1157706 Cross-References: CVE-2019-18899 CVE-2020-5202 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes two vulnerabilities is now...

Security update for libredwg (moderate)

openSUSE Security Update: Security update for libredwg Announcement ID: openSUSE-SU-2020:0096-1 Rating: moderate References: 1160520 1160522 1160523 1160524 1160525 1160526 1160527 Cross-References: CVE-2020-6609 CVE-2020-6610 CVE-2020-6611 CVE-2020-6612 CVE-2020-6613 CVE-2020-6614 CVE-2020-6615...

PT-2020-10183 · Symantec · Symantec Endpoint Detection/Response

Name of the Vulnerable Software and Affected Versions: Symantec Endpoint Detection and Response SEDR versions prior to 4.3.0 Description: The issue is related to a cross site scripting XSS problem, which can allow attackers to inject client-side scripts into web pages viewed by other users. This...

Intel Processor Graphics Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-30350 Potential Impact: Information Disclosure Severity: Medium Scope of Impact: Industry-wide CVE Identifier: CVE-2019-14615 Summary Description: Intel reported a potential security vulnerability in Intel Processor Graphics software that may allow information...

GHSA-92VM-WFM5-MXVV cookie-signature Timing Attack

Affected versions of cookie-signature are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison. Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the...

PT-2020-10376 · Sqlite +6 · Sqlite +6

Name of the Vulnerable Software and Affected Versions: SQLite version 3.30.1 Description: The issue is related to the selectExpander function in the select.c file of SQLite. This function proceeds with WITH stack unwinding even after a parsing error occurs. Recommendations: For SQLite version...

DEBIAN-CVE-2019-16780

WordPress users with lower privileges like contributors can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This...

PT-2019-15988 · FFmpeg · Ffjpeg

Name of the Vulnerable Software and Affected Versions: ffjpeg through 2019-08-21 Description: The issue is related to a divide-by-zero error in the jfif decode function, located in jfif.c. This error occurs in ffjpeg. Recommendations: For ffjpeg through 2019-08-21, consider updating to a version...

PT-2019-14725 · Jenkins · Jenkins Rapiddeploy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins RapidDeploy Plugin version 4.1 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified web server. Recommendations: For Jenkins RapidDeploy Plugin version 4.1 and earlier, updat...

PT-2019-14726 · Jenkins · Jenkins Rapiddeploy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins RapidDeploy Plugin versions 4.1 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified web server. Recommendations: For Jenkins RapidDeploy...

PT-2019-15957 · Atasm · Atasm

Name of the Vulnerable Software and Affected Versions: ATasm version 1.06 Description: The issue is a stack-based buffer overflow in the parse expr function, located in setparse.c, which can be triggered by a crafted .m65 file. Recommendations: For ATasm version 1.06, as a temporary workaround,...

samba:fuzz_ndr_drsblobs_TYPE_STRUCT: Heap-buffer-overflow in ndr_push_scheduleHeader

Project: https://gitlab.com/samba-team/samba.git Detailed Report: https://oss-fuzz.com/testcase?key=6295741442293760 Project: samba Fuzzing Engine: libFuzzer Fuzz Target: fuzzndrdrsblobsTYPESTRUCT Job Type: libfuzzerasansamba Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Addres...

PT-2019-13483 · Unknown · En100 Ethernet Module Iec 61850 Variant +4

Name of the Vulnerable Software and Affected Versions: EN100 Ethernet module DNP3 variant All versions EN100 Ethernet module IEC 61850 variant All versions V4.37 EN100 Ethernet module IEC104 variant All versions EN100 Ethernet module Modbus TCP variant All versions EN100 Ethernet module PROFINET ...

PT-2019-5579 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Intel FPGA SDK for OpenCL Pro Edition versions prior to 19.4 Description: The issue is related to an improper conditions check in the Linux kernel driver, which may allow an authenticated user to potentially enable denial of service via local...