Ubuntu 16.04 LTS : Tomcat vulnerabilities (USN-4557-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4557-1 advisory. It was discovered that the Tomcat realm implementations incorrectly handled passwords when a username didn't exist. A remote attacker could possibly use...

Kernel: kvm: nVMX: L2 guest may trick the L0 hypervisor to access sensitive L1 resources

A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested=1 virtualization is enabled. In the instruction emulation, the L2 guest could trick the L0 hypervisor into accessing sensitive bits of the L1 hypervisor. An L2 guest could use this flaw to...

Kernel: kvm: nVMX: L2 guest may trick the L0 hypervisor to access sensitive L1 resources

A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested=1 virtualization is enabled. In the instruction emulation, the L2 guest could trick the L0 hypervisor into accessing sensitive bits of the L1 hypervisor. An L2 guest could use this flaw to...

Memory corruption vulnerability exists in WPS Office Campus Edition of Zhuhai Kingsoft Office Software Co. Ltd (CNVD-2020-58352)

WPS Office Campus Edition is designed for school teachers and students, embedded with massive educational teaching resources. A memory corruption vulnerability exists in WPS Office Campus Edition of Zhuhai Kingsoft Office Software Company Limited, which can be exploited by attackers to cause a...

PT-2022-4500 · Dpdk +9 · Dpdk +9

Name of the Vulnerable Software and Affected Versions: DPDK affected versions not specified Description: A permissive list of allowed inputs flaw was found in DPDK, allowing a remote attacker to cause a denial of service by sending a crafted Vhost header. The issue is related to the copy desc to...

CPU exhaustion caused by DoS against Confluence server by requesting static batch resources

The details of this issue can be viewed here: https://asecurityteam.atlassian.net/browse/VULN-170040 The source code is located at: https://bitbucket.org/atlassian/atlassian-plugins-webresource/src/master/...

CVE-2020-2281

A cross-site request forgery CSRF vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserve, unlock, and reset resources...

CVE-2020-2281

A cross-site request forgery CSRF vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserve, unlock, and reset resources...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserve, unlock, and reset resources...

CVE-2020-2281

The CVE-2020-2281 issue affects Jenkins Lockable Resources Plugin versions 2.8 and earlier. The root cause is CSRF due to endpoints not requiring POST, allowing attackers to reserve, unreserve, unlock, and reset resources. Impact is limited to the affected plugin’s resources as described in the s...

CVE-2020-2281

A cross-site request forgery CSRF vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserve, unlock, and reset resources...

LY Corporation: Path traversal in a Tomcat server

A path traversal vulnerability was discovered in a Tomcat server, which allowed an attacker to access internal resources such as the administrator page. The vulnerability was caused by a misconfiguration between the reverse proxy and the WAS, and occurred when the attacker entered the string "..;...

PT-2020-15510 · Jenkins · Jenkins Lockable Resources Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Lockable Resources Plugin versions 2.8 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to reserve, unreserve, unlock, and reset resources. This issue arises because the plugin does not require...

Mozilla Firefox Resource Management Error Vulnerability (CNVD-2020-54999)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a resource management error vulnerability. The vulnerability arises from improper management of system resources e.g., memory, disk space, files, etc. by a network system o...

CVE-2020-16202

WebAccess Node All versions prior to 9.0.1 has incorrect permissions set for resources used by specific services, which may allow code execution with system privileges...

Man-in-the-middle (MitM)

Firefox is vulnerable to man-in-the-middle MitM. The Upgrade-Insecure-Requests UIR specification states that if UIR is enabled through Content Security Policy CSP, navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the...

SecOps Teams Wrestle with Manual Processes, HR Gaps

Only about half of enterprises are satisfied with their ability to detect cybersecurity threats, according to a survey from Forrester Consulting – with respondents painting a picture of major resource and technology gaps hamstringing their efforts to block cyberattacks. According to the...

Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain

A flaw was found in Wildfly, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources...

Authorization

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secur...

CVE-2020-25032

A flaw was found in Flask-CORS aka CORS Middleware for Flask. This issue allows the ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format. The highest threat from this vulnerability is to confidentiality...