CVE-2020-15481

An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 Build 1008. The kernel driver exposes IOCTL functionality that allows low-privilege users to map arbitrary physical memory into the address space of the calling process. This cou...

CVE-2020-15481: Undefined Security Weakness

An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 Build 1008. The kernel driver exposes IOCTL functionality that allows low-privilege users to map arbitrary physical memory into the address space of the calling process. This cou...

PT-2020-14448

Name of the Vulnerable Software and Affected Versions PassMark BurnInTest versions 9.1 Build 1008 OSForensics versions 7.1 Build 1012 PerformanceTest versions 10.0 Build 1008 Description An issue was discovered that allows low-privilege users to map arbitrary physical memory into the address spac...

Information Disclosure

kernel is vulnerable to information disclosure.It incorrectly writes to the /proc/sys/vm/cmmtimeout file.This flaw allows to local user see the kernel stack information leak on s390/s390x...

Uninitialized Memory Disclosure

Linux kernel is vulnerable to uninitialized memory disclosure. Possibility of limited and random memory access when reading the /proc/sys/kernel/rhfeatures file...

new module: perl:5.30

An update is available for perl-Pod-Perldoc, perl-DBI, perl-Pod-Escapes, perl-Devel-PPPort, perl-Pod-Usage, perl-Sub-Exporter, perl-perlfaq, perl-Object-HashBase, perl-CPAN-Meta-YAML, perl-Digest, perl-podlators, perl-bignum, perl-Text-ParseWords, perl-Text-Template, perl-DBD-MySQL, perl-Text-Glo...

KPMCore: Root privilege escalation

Background KPMcore, the KDE Partition Manager core, is a library for examining and modifying partitions, disk devices, and filesystems on a Linux system. It provides a unified programming interface over top of external system-manipulation tools. Description Improper checks on the D-Bus request...

WARNING: Google Discloses Windows Zero-Day Bug Exploited in the Wild

Google has disclosed details of a new zero-day privilege escalation flaw in the Windows operating system that's being actively exploited in the wild. The elevation of privileges EoP vulnerability, tracked as CVE-2020-17087, concerns a buffer overflow present since at least Windows 7 in the Window...

CVE-2020-24990

An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote attacker can perform a directory traversal and obtain operating system files via a TFTP GET request, as demonstrated by reading /etc/passwd or /proc/version...

CVE-2020-24990

The CVE-2020-24990 issue affects QSC Q-SYS Core Manager 8.2.1 via the TFTP service on UDP/69, enabling a directory traversal to read OS files (e.g., /etc/passwd, /proc/version). Root cause: TFTP GET requests bypass path filtering. Impact is partial confidentiality loss without integrity/availabil...

CVE-2020-24990: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote attacker can perform a directory traversal and obtain operating system files via a TFTP GET request, as demonstrated by reading /etc/passwd or /proc/version...

PT-2020-15879

Name of the Vulnerable Software and Affected Versions QSC Q-SYS Core Manager version 8.2.1 QSC Q-SYS Core Manager versions prior to 8.2.1 Description An issue was discovered in QSC Q-SYS Core Manager. A remote attacker can perform a directory traversal via the TFTP service running on UDP port 69...

IBM Resilient Command Injection Vulnerability

IBM Resilient is a suite of incident response platforms from IBM in the United States. The platform supports functions such as incident response process orchestration and incident management. Resilient has a security vulnerability that can be exploited by an attacker to inject malicious commands...

CVE-2020-6648: Cleartext Storage of Sensitive Information

A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executi...

PT-2020-19203

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.2.4 and earlier FortiProxy versions 2.0.0, 1.2.9 and earlier Description A cleartext storage of sensitive information issue in the command line interface may allow an authenticated attacker to obtain sensitive information,...

Security Bulletin: IBM Resilient SOAR could allow a privileged user to inject malicious commands through Python3 scripting (CVE-2020-4636).

Summary It was possible for a privileged user to inject malicious commands through Python3 scripting, using the sys module, in a Beta version of Resilient. Vulnerability Details CVEID: CVE-2020-4636 DESCRIPTION: IBM Resilient could allow a privileged user to inject malicious commands through...

EulerOS Virtualization for ARM 64 3.0.6.0 : perl-Sys-Syslog (EulerOS-SA-2020-2039)

According to the version of the perl-Sys-Syslog package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - It was found that perl can load modules from the current directory if not found in the module directories, via th...

Huawei EulerOS: Security Advisory for perl-Sys-Syslog (EulerOS-SA-2020-2039)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial Of Service (DoS)

linux is vulnerable to denial of service DoS. There is a net/ipv4/tcpinput.c signed integer overflow in tcpackupdatertt when userspace writes a very large integer to /proc/sys/net/ipv4/tcpminrttwlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6...

CVE-2020-10781

CVE-2020-10781 affects the Linux kernel ZRAM module: a local attacker who can read /sys/class/zram-control/hot_add can create ZRAM device nodes in /dev, and repeated reads can allocated memory and trigger OOM killer, potentially making the system inoperable. Connected advisories (e.g., ALAS2KERNE...