squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution

A flaw was found in Squid, where a remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This issue occurs because the attacker can overflow the nonce reference counter, which results in remote code execution if the pooled token...

squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution

A flaw was found in Squid, where a remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This issue occurs because the attacker can overflow the nonce reference counter, which results in remote code execution if the pooled token...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:1142-1)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATEHOSTR1 to store r1 state in kvmppchventry plus in kvmppcsave,restoretm, leading to a stack...

The vulnerability of the ReadCUTImage function in the console-based image editing tool ImageMagick, related to the use of uninitialized resources, allows attackers to access confidential information or cause service failures.

The vulnerability of the ReadCUTImage function in the console-based ImageMagick graphics editor is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to gain access to confidential information or cause service failures...

libreoffice: Remote resources protection module not applied to bullet graphics

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed...

systemd: services with DynamicUser can create SUID/SGID binaries

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially...

Resource consumption vulnerability in giflib

giflib is a library for reading and writing gif images. A resource consumption vulnerability exists in giflib, which can be exploited by an attacker to consume system resources...

RHEL 7 : Satellite 6.7 . (Important) (RHSA-2020:1454)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1454 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring...

Simplifying Data Center and IaaS Visibility and Protection

Helping customers further secure their on-premises data centers and IaaS deployments is an interesting new use case for our Enterprise Threat Protector service. Enterprises typically have a significant number of applications that are deployed and run in these environments. I'm using the word...

Information Disclosure

github.com/helm/helm is susceptible to information disclosure. When Helm template lookup function is run, it no longer restricts to not to make a call to the cluster during the helm template and helm install|update|delete|rollback --dry-run without any notification to the user, allowing it to che...

The vulnerability of Google Chrome, related to improper control of access to critical resources, allows a violator to gain unauthorized access.

The vulnerability of Google Chrome relates to improper control of access to a critical resource. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to information through a specially created HTML page...

The vulnerability of Firefox browser, related to the improper assignment of access rights for critical resources, allows attackers to gain unauthorized access to information.

The vulnerability of Firefox browsers is related to the improper assignment of access rights for critical resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to information...

Squid Code Execution Vulnerability

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in versions of Squid prior to 5.0.2. An attacker can exploit the vulnerability by...

Arbitrary File Download Vulnerability in Education Resources Cloud Platform

Guangzhou Ncast Electronic Technology Co., Ltd hereinafter referred to as Ncast, founded in 2007, is a high-tech enterprise focusing on three major fields of multimedia communication, video and audio coding and decoding, and intelligent image processing. An arbitrary file download vulnerability...

CVE-2020-11945

An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter a short integer. Remote code execution may occur if...

The vulnerability of the Python ECDSA cryptographic library, related to insufficient processing of exceptional states, allows a perpetrator to trigger a service failure.

The vulnerability of the Python ECDSA cryptographic library involves simultaneous operations using a shared resource with incorrect synchronization. Exploiting this vulnerability can allow a remote attacker to cause service failures...

XML External Entity

dom4j is vulnerable to XML external entity attacks. The default SaxReader does not disable external DTDs and External Entities by default, allowing an attacker to access local or internal network resources, or perform requests on behalf of the server...

Regular Expression Denial Of Service (ReDoS)

xlsx is vulnerable to regular expression denial of service. An attacker is able to cause the application to consume excessive resources which can potentially lead to an application crash using a malicious string...

The vulnerability of Google Chrome browser developer tools lies in improper control of access to critical resources, allowing attackers to gain unauthorized access.

The vulnerability of Google Chrome browser developer tools is related to improper control over access to critical resources. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to information through a specially created HTML page...

The vulnerability of the Omnibox address bar in Google Chrome, related to improper access control to critical resources, allows attackers to compromise data integrity.

The vulnerability of the Omnibox address bar in Google Chrome relates to improper control of access to critical resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise data integrity using a specially created domain name...