CVE-2019-18794

The BASS Audio Library 2.4.14 under Windows is prone to a BASSStreamCreateFile Use after Free vulnerability via a crafted .ogg file. An attacker can exploit this to gain access to sensitive information that may aid in further attacks. A failure in exploitation leads to denial of service...

aesni (>=0.7.0, <=0.9.0), asuran (>=0.1.1, <=0.1.6) +22 more potentially affected by unknown CVE via stream-cipher (>=0.4.1, <=0.7.1)

stream-cipher CARGO version =0.4.1, =0.7.0, =0.1.1, =0.1.1, =0.4.0, =0.5.0, =0.2.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.3.1, =0.2.0, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0058...

Fix of 227 CVE

Fix bug 69720: Null pointer dereference in phargetfpoffset - Fix bug 70728: Type Confusion Vulnerability in PHPtoXMLRPCworker - Fix bug 70661: Use After Free Vulnerability in WDDX Packet Deserialization - Fix bug 70741: Session WDDX Packet Deserialization Type Confusion Vulnerability - Fix bug...

RUSTSEC-2020-0058 crate has been renamed to `cipher`

This crate has been renamed from stream-cipher to cipher. The new repository location is at:...

CLSA-2020-1605798462 Fix of 227 CVE

Fix bug 69720: Null pointer dereference in phargetfpoffset - Fix bug 70728: Type Confusion Vulnerability in PHPtoXMLRPCworker - Fix bug 70661: Use After Free Vulnerability in WDDX Packet Deserialization - Fix bug 70741: Session WDDX Packet Deserialization Type Confusion Vulnerability - Fix bug...

chromium-browser: Use after free in WebRTC

Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC stream...

SQL Injection Vulnerability in Lean Value Stream Management System (LVS) at Hangzhou Gila Technology Co.

Hangzhou Gila Technology Co., Ltd. is an enterprise network service provider, is committed to providing customized solutions based on the needs of the enterprise network, to create a cloud service cloud network platform. A SQL injection vulnerability exists in the Lean Value Stream Management...

Microsoft Windows Media Foundation H265 Stream Parsing Remote Code Execution (CVE-2020-16915)

A code execution vulnerability exists in Microsoft Windows Media Foundation. The vulnerability is due to improper validation of H265 media files. A remote attacker could exploit the vulnerability by enticing a victim user to open a maliciously crafted media file or open the folder containing the...

CVE-2020-26945

MyBatis before 3.5.6 mishandles deserialization of object streams...

qemu-kvm security update

1.5.3-175.el79.1 - Fixing release number for z-stream...

rdkit:mol_data_stream_to_mol_fuzzer: Use-of-uninitialized-value in RDKit::FileParserUtils::finishMolProcessing

Project: https://github.com/rdkit/rdkit.git Detailed Report: https://oss-fuzz.com/testcase?key=5182941669621760 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: moldatastreamtomolfuzzer Job Type: libfuzzermsanrdkit Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

CVE-2020-24216: Undefined Security Weakness

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. When the administrator configures a secret URL for RTSP streaming, the stream is still available via its default name such as /0. Unauthenticated attackers can view video streams that are meant to b...

Denial Of Service (DoS)

freerdp is vulnerable to denial of service DoS. The attacker use stream pointer out of bounds in updaterecvsecondaryorder read later could lead crash the application...

PT-2020-22034

Name of the Vulnerable Software and Affected Versions ZeroMQ affected versions not specified Description The issue is related to a heap buffer overflow error. Technical details about the error include a crash type of Heap-buffer-overflow WRITE and a crash state involving several functions: zmq::t...

libzmq:socket_connect_fuzzer: Heap-buffer-overflow in zmq::tcp_read

Project: https://github.com/zeromq/libzmq.git Detailed Report: https://oss-fuzz.com/testcase?key=4686903000170496 Project: libzmq Fuzzing Engine: afl Fuzz Target: socketconnectfuzzer Job Type: aflasanlibzmq Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x625000013900...

Man-in-the-Middle (MitM)

twitter-stream is vulnerable to man-in-the-middle MitM. Lack of hostname validation allows an attacker to perform a man-in-the-middle attack to intercept and modify network traffic...

LY Corporation: Webview in LINE client for iOS will render application/octet-stream files as HTML

Due to misconfiguration in the webview of LINE client for iOS, the data with header "Content-type" as "application/octet-stream" was treated as HTML. This could lead to a malicious Javascript execution, resulting a Cross-site scripting attack...

DEBIAN-CVE-2020-6532

Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Cross-site Scripting (XSS)

Activity Stream is vulnerable to cross-site scripting XSS. It can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Strea...

Integer overflow

An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. When processing an object stream from a PDF document, the application will perform a calculation in order to allocate memory for...