Security Advisory - Privilege Escalation Vulnerability in Some Huawei Products

There is a privilege escalation vulnerability in some Huawei products. Due to insufficient input validation, a local attacker with high privilege may execute some specially crafted scripts in the affected products. Successful exploit will cause privilege escalation. Vulnerability ID:...

OPENSUSE-SU-2020:2141-1 Security update for mutt

This update for mutt fixes the following issues: - CVE-2020-28896: incomplete connection termination could lead to sending credentials over unencrypted connections bsc1179035 - Avoid that message with a million tiny parts can freeze MUA for several minutes bsc1179113 This update was imported from...

DLA-2475-1 pdfresurrect - security update

Bulletin has no description...

SUSE-SU-2020:3549-1 Security update for nodejs12

This update for nodejs12 fixes the following issues: Update to 12.19.1 fixing: - CVE-2020-8277: Denial of Service through DNS request bsc1178882...

OPENSUSE-SU-2020:2064-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - DBD::File drivers can open files from folders other than those specifically passed via the fdir attribute in the data source name DSN. bsc1176492, CVE-2014-10401, CVE-2014-10402 This update was imported from the SUSE:SLE-15-SP2:Update update...

Fuji Electric V-Server Lite

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Fuji Electric Equipment: V-Server Lite Vulnerability: Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could allow for remote code execution on the device. 3. TECHNICAL DETAILS 3.1...

MGASA-2020-0437 Updated tcpreplay package fixes security vulnerabilities

An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap buffer overflow vulnerability in MemcmpInterceptorCommon that can make tcpprep crash and cause a denial of service CVE-2020-24265. An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap buffer overflow vulnerabilit...

SUSE-SU-2020:3478-1 Security update for c-ares

This update for c-ares fixes the following issues: - Version update to 1.17.0 CVE-2020-8277: Fixed a Denial of Service through DNS request bsc1178882 For further details see https://c-ares.haxx.se/changelog.html...

PT-2020-5797

Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions 1.2.0 through 1.2.12 Roundcube Webmail versions 1.3.x through 1.3.15 Roundcube Webmail versions 1.4.x through 1.4.9 Description: An issue was discovered in Roundcube Webmail, where the linkref addindex function in...

OPENSUSE-SU-2020:1990-1 Security update for SDL

This update for SDL fixes the following issues: Security issue fixed: - CVE-2019-13616: Fixed heap-based buffer over-read in BlitNtoN in video/SDLblitN.c when called from SDLSoftBlit bsc1141844. This update was imported from the SUSE:SLE-15:Update update project...

Hotfix XS82E004 - For Citrix Hypervisor 8.2

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.2. Information About this Hotfix Component| Details ---|--- Prerequisite| None Post-update tasks| None Content live patchable| No Baselines for Live Patch| N/A Revision History| Published on Oct 13, 2020...

Workload Balancing 8.2.1 - For Citrix Hypervisor 8.2

Who Should Install This Update? This Workload Balancing virtual appliance update is for customers who use the Workload Balancing feature of Citrix Hypervisor 8.2. It constitutes the following deliverable: File Name| CitrixHypervisor-8.2.1-wlb.xva ---|--- Description| This file provides an updated...

JVN#90729322: Hibernate ORM vulnerable to SQL injection

Hibernate ORM is an ORM framework for Java. Hibernate ORM can be configured hibernate.usesqlcomments to true, which is false by default to add comments to generated SQL statements, aimed at debugging purpose. When hibernate.usesqlcomments is configured to true, malicious input may produce...

Cisco IoT Field Network REST API Insufficient Input Validation Vulnerability

A vulnerability in the REST API of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. ...

Cisco Secure Web Appliance Privilege Escalation Vulnerability

A vulnerability in the log subscription subsystem of Cisco AsyncOS for the Cisco Secure Web Appliance formerly Web Security Appliance could allow an authenticated, local attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of...

DSA-4793-1 firefox-esr - security update

Bulletin has no description...

About the security content of macOS Big Sur 11.0.1

About the security content of macOS Big Sur 11.0.1 This document describes the security content of macOS Big Sur 11.0.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

Cisco IOS XE Software PROFINET Link Layer Discovery Protocol DoS (cisco-sa-ios-profinet-dos-65qYG3W5)

According to its self-reported version and configuration, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the PROFINET handler for Link Layer Discovery Protocol LLDP messages. An unauthenticated, adjacent attacker can exploit thisby sendi...

OPENSUSE-SU-2020:1929-1 Security update for chromium

This update for chromium fixes the following issues: Update to 86.0.4240.198 boo1178703 - CVE-2020-16013: Inappropriate implementation in V8 - CVE-2020-16017: Use after free in site isolation Update to 86.0.4240.193 boo1178630 - CVE-2020-16016: Inappropriate implementation in base...

OPENSUSE-SU-2020:1922-1 Security update for python-waitress

This update for python-waitress to 1.4.3 fixes the following security issues: - CVE-2019-16785: HTTP request smuggling through LF vs CRLF handling bsc1161088. - CVE-2019-16786: HTTP request smuggling through invalid Transfer-Encoding bsc1161089. - CVE-2019-16789: HTTP request smuggling through...