OPENSUSE-SU-2020:1680-1 Security update for libproxy

This update for libproxy fixes the following issues: - CVE-2020-25219: Rewrote url::recvline to be nonrecursive bsc1176410. - CVE-2020-26154: Fixed a buffer overflow when PAC is enabled bsc1177143. This update was imported from the SUSE:SLE-15:Update update project...

CVE-2020-16938

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log on ...

OPENSUSE-SU-2020:1677-1 Security update for rubygem-activesupport-5_1

This update for rubygem-activesupport-51 fixes the following issues: - CVE-2020-8165: Fixed deserialization of untrusted data in MemCacheStore potentially resulting in remote code execution bsc1172186 This update was imported from the SUSE:SLE-15:Update update project...

CVE-2020-9862

A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web...

MGASA-2020-0385 Updated brotli packages fix security vulnerability

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB CVE-2020-8927...

PT-2020-20067 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server version 19.0.1 Description: The issue is related to insufficient protection of server-side encryption keys, allowing an attacker to replace these keys. Recommendations: For Nextcloud Server version 19.0.1, update to a version...

PT-2020-20000 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server version 18.0.4 Description: A too small set of random characters being used for encryption allowed decryption in a shorter time than intended. Recommendations: For Nextcloud Server version 18.0.4, update to a version that use...

PT-2020-4303

Name of the Vulnerable Software and Affected Versions: ARC Informatique PcVue versions prior to 12.0.17 Description: The issue is related to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server. This is due to...

Security Bulletin: NVIDIA GPU Display Driver - September 2020

NVIDIA has released a software security update for NVIDIA® GPU Display Driver. This update addresses issues that may lead to denial of service, code execution, escalation of privileges, or information disclosure. To protect your system, download and install this software update from the NVIDIA...

DLA-2404-1 eclipse-wtp - security update

Bulletin has no description...

Cisco SD-WAN vManage Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly...

Cisco Webex Teams Client for Windows DLL Hijacking Vulnerability

A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an authenticated, local attacker to load a malicious library. To exploit this vulnerability, the attacker needs valid credentials on the Windows system. The vulnerability is due to...

DLA-2400-1 activemq - security update

Bulletin has no description...

NVIDIA GPU Display Driver - September 2020 Security Bulletin - Lenovo Support US

Lenovo Security Advisory: LEN-47663 Potential Impact: Denial of service, code execution, privilege escalation, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2020-5979 , CVE-2020-5980, CVE-2020-5981, CVE-2020-5981 , CVE-2020-5982, CVE-2020-5983,...

PT-2020-19758 · Hello.Js · Hellojs

Name of the Vulnerable Software and Affected Versions: hellojs versions prior to 1.18.6 hello.js versions prior to 1.18.6 Description: The issue arises from the package getting the oauth redirect parameter from the URL and passing it to location.assign without proper checks and sanitization. This...

Exploit for Missing Authentication for Critical Function in Clickstudios Passwordstate

CVE-2020-26061 ClickStudios Passwordstate Password Reset Por...

PT-2020-6188 · Mariadb +8 · Mariadb +9

Name of the Vulnerable Software and Affected Versions: mariadb versions prior to 10.1.47 mariadb versions prior to 10.2.34 mariadb versions prior to 10.3.25 mariadb versions prior to 10.4.15 mariadb versions prior to 10.5.6 Description: The issue is related to errors in input data processing duri...

PT-2022-8871 · Upx +2 · Upx +2

Name of the Vulnerable Software and Affected Versions: UPX version 4.0.0 Description: An invalid memory address reference was discovered in the elf lookup function in p lx elf.cpp via a crafted Mach-O file. Recommendations: For UPX version 4.0.0, consider updating to a newer version that contains...

Cisco Issues Patches For 2 High-Severity IOS XR Flaws Under Active Attacks

Cisco yesterday released security patches for two high-severity vulnerabilities affecting its IOS XR software that were found exploited in the wild a month ago. Tracked as CVE-2020-3566 and CVE-2020-3569, details for both zero-day unauthenticated DoS vulnerabilities were made public by Cisco late...

MGASA-2020-0379 Updated gnutls packages fix security vulnerability

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a norenegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the...