CVE-2020-6233

SAP S/4 HANA Financial Products Subledger and Banking Services, versions - FSAPPL 400, 450, 500 and S4FPSL 100, allows an authenticated user to run an analysis report due to Missing Authorization Check, resulting in slowing the system...

CVE-2020-6233

SAP S/4 HANA Financial Products Subledger and Banking Services, versions - FSAPPL 400, 450, 500 and S4FPSL 100, allows an authenticated user to run an analysis report due to Missing Authorization Check, resulting in slowing the system...

CVE-2020-6186

SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, leading to Denial of Service...

Default credentials

SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, leading to Denial of Service...

FreeRDP < 2.0.0 Memory Leak Vulnerability

FreeRDP is prone to a memory leak vulnerability. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundatio...

GHSA-H5JV-4P7W-64JG Django Denial-of-service in strip_tags()

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.striptags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities...

PYSEC-2019-12

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.striptags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities...

Regular Expression Denial Of Service (ReDoS)

no-case is vulnerable to regular expression denial of service ReDoS attacks. The library does not properly sanitize user input strings, causing slowdown when matching strings that can lead to a ReDoS...

CVE-2017-16098

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTPMAXHEADERSIZE= option the default header max length is 80kb, so the impact of the ReDoS is...

February 22, 2018—KB4075211 (Preview of Monthly Rollup)

None None...

A week in security (January 15 – January 21)

Last week on Labs, we gave you some background information about cookies, specifically which ones to worry about and why. We also warned you about scams surrounding the Mega Millions winner, who promised to donate his money to good causes. We analyzed a cryptocurrency miner using a very old...

Apple Preps ChaiOS iMessage Bug Fix for Next Week

UPDATE The so-called ChaiOS message bug identified this week in Apple iOS devices will receive a fix with the rollout of the update for iOS 11.2.5, expected next week. The update will address a flaw software developer Abraham Masri publicly identified in a tweet earlier this week, according to...

HP Silently Installs Telemetry Bloatware On Your PC—Here's How to Remove It

Do you own a Hewlett-Packard HP Windows PC or laptop? Multiple HP customers from around the world are reporting that HP has started deploying a "spyware" onto their laptops—without informing them or asking their permission. The application being branded as spyware is actually a Windows Telemetry...

The vulnerability of the `gdImageCreate` function in the GD Graphics Library allows a attacker to trigger a service failure.

The vulnerability of the gdImageCreate function in the GD Graphics Library exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure system slowdown by using an overly large image size...

Huawei Eudemon 8000E Denial of Service Vulnerability

Huawei Eudemon8000E is a new generation of high-performance T-class security gateway for carriers from Huawei China. A security vulnerability exists in Huawei Eudemon8000E V200R001C01SPC800 and earlier versions. An attacker can exploit the vulnerability by sending a large number of TCP messages t...

Code injection

IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a specially crafted and malformed URL...

CVE-2016-0206

IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a specially crafted and malformed URL...

CVE-2016-0206

IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a specially crafted and malformed URL...

CVE-2016-0206

IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a specially crafted and malformed URL...

Malicious Cryptocurrency Mining tool turns Computers into Zcash Mining Machines

Since its launch over a month ago, new virtual currency Zcash ZEC has become a significant way for cybercrooks to make money by infecting computers with software mining program. Launched in late October, Zcash ZEC is a new cryptocurrency currency that claims to be more anonymous than Bitcoin, as...