Security Bulletin: Vulnerabilities in OpenSSL affect LCM8 & LCM16 KVM Switch Firmware and GCM16 & GCM32 KVM Switch Firmware (CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2015-1794)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by LCM8 and LCM16 KVM Switch Firmware and GCM16 and GCM32 KVM Switch Firmware. LCM8 and LCM16 KVM Switch Firmware and GCM16 and GCM32 KVM Switch Firmware have addressed the applicable CVEs...

CVE-2020-16246

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site...

CVE-2020-16246

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site...

Cross site scripting

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site...

CVE-2020-16246

The CVE-2020-16246 entry pertains to GE Reason S20 Ethernet Switches (S2020, S2024) affected by cross-site scripting due to improper neutralization of input during web page generation (CWE-79). Root cause: unvalidated/unsanitized input in the web interface enables crafted requests to render malic...

PT-2020-14839

Name of the Vulnerable Software and Affected Versions Reason S20 Ethernet Switch affected versions not specified Description The issue allows attackers to perform cross-site scripting XSS attacks, which may trick users into following a link or navigating to a page that posts a malicious JavaScrip...

CVE-2020-16246: Improper Neutralization of Input During Web Page Generation

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site...

HPE KVM IP Console Switches Remote Code Injection Vulnerability

HPE KVM IP Console Switches is an HP switch device. A remote code injection vulnerability exists in HPE KVM IP Console Switches, which allows remote attackers to exploit the vulnerability by submitting a special request to execute arbitrary code in an application context...

HPE KVM IP Console Switches Cross-Site Scripting Vulnerability

HPE KVM IP Console Switches is an HP switch device. A cross-site scripting vulnerability exists in HPE KVM IP Console Switches, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack...

Team Xecuter members arrested for selling Nintendo Switch hacks

By Deeba Ahmed Max Louarn, Yuanning Chen, and Gary Bowser who are alleged members of Team Xecuter were charged with 11 felony counts. This is a post from HackRead.com Read the original post: Team Xecuter members arrested for selling Nintendo Switch hacks...

expat: heap-based buffer over-read via crafted XML input

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber then resulted in a heap-based buffer over-read...

PT-2020-4296

Name of the Vulnerable Software and Affected Versions: Moxa EDR-810 affected versions not specified Description: The issue is related to a lack of protection for service data in the Moxa EDR-810 switch firmware. Exploitation of this issue could allow a remote attacker to disclose protected...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service DoS. The vulnerability exists when the eager runtime traverses all tensors in the output, and a tensor could be a null pointer when it is processed from tf.rawops.Switch...

CVE-2020-15190

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. Howeve...

CVE-2020-15190

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. Howeve...

Design/Logic Flaw

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. Howeve...

PYSEC-2020-305

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. Howeve...

PYSEC-2020-270

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. Howeve...

PYSEC-2020-113

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. Howeve...

PYSEC-2020-113

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. Howeve...