JVN#44764844: MELSEC iQ-R Series CPU Modules vulnerable to uncontrolled resource consumption

MELSEC iQ-R series CPU modules provided by Mitsubishi Electric Corporation contain an uncontrolled resource consumption vulnerability CWE-400. According to the developer, in case of "To Use or Not to Use Web Server Settings" in the parameter of CPU modules are set to "Not Use", this issue does no...

PT-2020-11855 · Apple · Macos High Sierra +5

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.2 iPadOS versions prior to 14.2 macOS Catalina versions prior to 10.15.7 macOS High Sierra versions prior to Security Update 2020-005 macOS Mojave versions prior to Security Update 2020-005 Description: An out-of-boun...

Vulnerability fixed in Adobe Reader Mobile

A vulnerability has been fixed in Adobe Reader Mobile for Android. A malicious party could exploit the vulnerability to gain access to sensitive data in the context of the victim. Adobe has released updates to fix the vulnerability in Reader Mobile 20.9.0. For more information, see:...

DLA-2448-1 firefox-esr - security update

Bulletin has no description...

Security Advisory - Denial of Service Vulnerability in Some Huawei Products

There is a denial of service vulnerability in some Huawei products. There is no protection against the attack scenario of specific protocol. A remote, unauthorized attacker can construct attack scenarios, which lead to denial of service. Vulnerability ID: HWPSIRT-2020-79490 This vulnerability has...

Cisco IOS XR Software Slow Path Forwarding Denial of Service Vulnerability

A vulnerability in the egress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers and Cisco Network Convergence System NCS 5000 Series Routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an...

PT-2020-5824 · Schneider Electric · Ecostruxure Building Operation Webreports

Name of the Vulnerable Software and Affected Versions: EcoStruxure Building Operation WebReports versions 1.9 through 3.1 Description: A CWE-284 Improper Access Control issue exists that could allow a remote attacker to access restricted web resources due to improper access control, potentially...

Security Bulletin: NVIDIA GeForce NOW - November 2020

NVIDIA has released a software update for NVIDIA® GeForce NOW™ application software on Windows. This update addresses a security issue that may lead to code execution or escalation of privileges. To protect your system, open the GeForce NOW application to automatically download the update and...

Intel® Media SDK for Windows* Advisory

Summary: A potential security vulnerability in the Intel® Media SDK for Windows may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2019-11121 Description: Improper file permissions in the installer for...

Intel® 50GbE IP Core for Intel® Quartus Prime Advisory

This advisory contains CVEs in Altera products and has been transferred to Altera for support. The updated advisory can be found at the link below: https://www.altera.com/product-security/advisory-archive/intel-sa-00400.html...

DSA-4788-1 firefox-esr - security update

Bulletin has no description...

Intel Unite® Cloud Service Client Advisory

Summary: A potential security vulnerability in the Intel Unite® Cloud Service client may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details CVEID: CVE-2020-12331 Description: Improper access controls in Intel UniteR...

Open WebRTC Toolkit Advisory

Summary: A potential security vulnerability in the Open WebRTC Toolkit may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details CVEID: CVE-2020-12338 Description: Insufficient control flow management in the Open WebRTC...

SUSE-SU-2020:3255-1 Security update for u-boot

This update for u-boot fixes the following issues: CVE-2019-14192 bsc1143777, CVE-2019-14193 bsc1143817, CVE-2019-14199 bsc1143824, CVE-2019-14197 bsc1143821, CVE-2019-14200 bsc1143825, CVE-2019-14201 bsc1143827, CVE-2019-14202 bsc1143828, CVE-2019-14203 bsc1143830, CVE-2019-14204 bsc1143831,...

CVE-2020-3556

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to cause a targeted AnyConnect user to execute a malicious script. The vulnerability is due to a lack of authentication to the IPC listene...

CVE-2020-7198

There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer. HPE has provided updates to Oneview and Synergy Composer: Update to version 5.5 of OneView, Composer, or Composer2...

HPSBHF03699 rev. 2 - Intel® High Definition Audio Driver November 2020 Security Update

Potential Security Impact Escalation of Privilege Source: HP, HP Product Security Response Team PSRT Reported by: Intel VULNERABILITY SUMMARY Intel has informed HP of a potential security vulnerability identified in some Intel® High Definition Audio drivers which may allow escalation of privilege...

OPENSUSE-SU-2020:1843-1 Security update for transfig

This update for transfig fixes the following issues: Security issue fixed: - CVE-2019-14275: Fixed stack-based buffer overflow in the calcarrow function bsc1143650. This update was imported from the SUSE:SLE-15:Update update project...

HPSBHF03695 rev. 1 - Intel® HID Event Filter Driver November 2020 Security Update

Potential Security Impact Escalation of Privilege Source: HP, HP Product Security Response Team PSRT Reported By: Intel® VULNERABILITY SUMMARY Intel has informed HP of a potential security vulnerability identified in the Intel® Human Interface Device HID Event Filter Driver which may allow...

Cisco Integrated Management Controller Command Injection Vulnerability

A vulnerability in the web UI of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to inject arbitrary code and execute arbitrary commands at the underlying operating system level. The vulnerability is due to insufficient input validation. An attacker could...