openSUSE: Security Advisory for rust, (openSUSE-SU-2020:0933-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cisco UCS Director Cloupia Script Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco UCS Director Cloupia Script RCE', 'Description' = %q This module exploits an authentication bypass and directory traversals in Cisco UCS...

WS-2020-0365

nDPI in versions 1.6 to 3.0 is vulnerable to Heap-buffer-overflow in ndpicheckspotify , related to src/lib/protocols/spotify.c...

PT-2020-12440

Name of the Vulnerable Software and Affected Versions Centreon host-monitoring widget versions prior to 1.6.4, 18.10.3, 19.04.3, and 19.0.1 Centreon service-monitoring widget versions prior to 1.6.4, 18.10.5, 19.04.3, and 19.10.2 Centreon tactical-overview widget versions prior to 1.0.3, 18.10.1,...

WS-2020-0361

PcapPlusPlus in versions 17.11 to 19.12 is vulnerable to Heap-buffer-overflow in pcpp::HeaderField::HeaderField, related to Packet++/src/TextBasedProtocol.cpp...

WS-2020-0391

PcapPlusPlus in versions v17.11 to v19.12 is vulnerable to heap-buffer-overflow in pcpp::tbpmyownstrnlen, related to Packet++/src/TextBasedProtocol.cpp...

WS-2020-0394

PcapPlusPlus in versions v16.09 to v19.12 is vulnerable to Use-of-uninitialized-value in pcpp::SSLCertificateRequestMessage::SSLCertificateRequestMessage, related to Packet++/src/SSLHandshake.cpp...

WS-2020-0359

PcapPlusPlus in versions 19.04 to 19.12 is vulnerable to Use-of-uninitialized-value, related to Packet++/src/DnsResource.cpp...

WS-2020-0362

PcapPlusPlus in versions 19.04 and 19.12 is vulnerable to Use-of-uninitialized-value, related to Packet++/src/DnsResource.cpp...

Design/Logic Flaw

An issue was discovered in Ignite Realtime Spark 2.8.3 and the ROAR plugin for it on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the user are sent with the HTTP request. Th...

WS-2020-0320

Fluent Bit in versions v0.14.0 to v1.4.4 is vulnerable to heap-buffer-overflow in u8readescapesequence on src/flbunescape.c...

WS-2020-0382

pcapplusplus in versions 18.08 to 19.12 is vulnerable to Use-of-uninitialized-value in pcpp::Packet::setRawPacket, related to Packet++/src/Packet.cpp...

WS-2020-0346

The moudle qt5 in qt in versions from v5.14.0-beta1 to v5.14.0-beta3, v5.14.0-rc1 to v5.14.0-rc2, v5.14.0 to v5.14.2;v5.15.0-alpha1 and v5.15.0-beta1 to v5.15.0-beta4 is vulnerable to heap-buffer-overflow related to file src/gui/painting/qicc.cpp...

Vulnerability of the `exec` function in the gulp-scss-lint package from the NPM package manager, allowing attackers to execute arbitrary commands.

The vulnerability of the exec function in the src/command.js file of the gulp-scss-lint package exists because measures to eliminate special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag

Impact A mutation XSS affects users calling bleach.clean with all of: the svg or math in the allowed/whitelisted tags an RCDATA tag see below in the allowed/whitelisted tags the keyword argument strip=False Patches Users are encouraged to upgrade to bleach v3.1.2 or greater. Workarounds modify...

WS-2020-0355

nDPI in version 3.2 is vulnerable to Use-of-uninitialized-value , related to src/lib/protocols/tls.c...

CVE-2019-12366

The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12365

The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12370

The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12368

The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...