CVE-2020-7694: Improper Control of Generation of Code

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

Unauthorized Access Vulnerability in Time Sequence Android APP of Peanut Future (Guangzhou) Technology Co.

Time Sequence App is a schedule management software. Peanut Future Guangzhou Technology Co. Ltd Time Sequence APP for Android has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information...

How to perform OS upgrade on a Citrix Provisioning Server

Sequence to follow for OS upgrade on a PVS server...

Ntop nDPI Buffer Overflow Vulnerability (CNVD-2020-36701)

Ntop nDPI is an open source library for deep packet inspection from Ntop Italy. A buffer overflow vulnerability exists in the extractRDNSequence of the lib/protocols/tls.c file in Ntop nDPI 3.2 and earlier versions. The vulnerability stems from a network system or product performing operations in...

UBUNTU-CVE-2020-15474

In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c...

PT-2020-22280

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-use-after-free READ 8 crash has been reported. The crash involves the wmem strbuf get str function, dissect rrc PLMN IdentityWithOptionalMCC r6...

EulerOS Virtualization 3.0.6.0 : wpa_supplicant (EulerOS-SA-2020-1763)

According to the versions of the wpasupplicant package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The implementations of SAE in hostapd and wpasupplicant are vulnerable to side channel attacks as a result of observable...

rubygems: Escape sequence injection vulnerability in errors

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManagerrun calls alerterror without escaping, escape sequence injection is possible. There are many ways to cause an error...

rubygems: Escape sequence injection vulnerability in gem owner

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur...

rubygems: Escape sequence injection vulnerability in verbose

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteractionverbose calls say without escaping, escape sequence injection is possible...

rubygems: Escape sequence injection vulnerability in API response handling

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilitieswithresponse may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur...

CVE-2020-15334

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows escape-sequence injection into the /var/log/axxmpp.log file...

CVE-2020-15334

Zyxel CloudCNM SecuManager is affected in versions 3.1.0–3.1.1 by an escape-sequence injection into the /var/log/axxmpp.log file. The issue relates to the API endpoint handling that log file; the exact vulnerable parameters are not specified in the documents. No explicit exploit details or in-the...

CVE-2020-15334: Undefined Security Weakness

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows escape-sequence injection into the /var/log/axxmpp.log file...

Cross site scripting

Cross-site Scripting XSS vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record o...

PT-2020-21707

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the u8 read escape sequence, flb unescape string utf8,...

Malleable ECDSA Signature

jsrsasign uses a malleable ECDSA signature. The vulnerability exists as it does not check for overflows in the length of a sequence, and allows 0 characters appended or prepended to an integer to be verified as the same as without the extra 0 characters...

Updated ruby-RubyGems packages fix security vulnerability

Updated ruby-RubyGems package fixes security vulnerabilities The following vulnerabilities have been reported. CVE-2019-8320: Delete directory using symlink when decompressing tar CVE-2019-8321: Escape sequence injection vulnerability in verbose CVE-2019-8322: Escape sequence injection...

openSUSE Security Update : axel (openSUSE-2020-778)

This update for axel fixes the following issues : axel was updated to 2.17.8 : - CVE-2020-13614: SSL Certificate Hostnames were not verified boo1172159 - Replaced progressbar line clearing with terminal control sequence - Fixed parsing of Content-Disposition HTTP header - Fixed User-Agent HTTP...

CVE-2020-10061 Error handling invalid packet sequence

Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions...