Linux kernel 竞争条件问题漏洞

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A competitive condition vulnerability exists in mm/mmap.c in Linux kernel versions prior to 5.7.11. The vulnerability...

GLPI Insecure Direct Object Reference Vulnerability (CNVD-2020-67631)

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

Processmaker SQL注入漏洞

ProcessMaker is a software suite for workflow management that can be used to automate workflows, create documents, assign roles and users to processes, and more. download page /sysworkflow/en/neoclassic/reportTables/ in ProcessMaker 3.4.11 A SQL injection vulnerability exists in the sort paramete...

MGASA-2020-0404 Updated mariadb packages fix security vulnerabilities

The latest release of mariadb fixes some undisclosed easily exploitable vulnerabilities. CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 and CVE-2020-14812. Additionally some bugs are fixed: - Temporary tables can overwrite existing files MDEV-23569 - Crash on SELECT on a table with indexed virtua...

CVE-2020-10937

An issue was discovered in IPFS aka go-ipfs 0.4.23. An attacker can generate ephemeral identities Sybils and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later...

Code injection

An issue was discovered in IPFS aka go-ipfs 0.4.23. An attacker can generate ephemeral identities Sybils and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later...

CVE-2020-10937

CVE-2020-10937 affects IPFS (go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and abuse the IPFS connection management reputation system to poison routing tables, allowing eclipse of target nodes from the network. The primary details in the sources indicate this is a networ...

CVE-2020-10937

An issue was discovered in IPFS aka go-ipfs 0.4.23. An attacker can generate ephemeral identities Sybils and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later...

OPENSUSE-SU-2020:1783-1 Security update for xen

This update for xen fixes the following issues: - bsc1177409 - VUL-0: CVE-2020-27673: xen: x86 PV guest INVLPG-like flushes may leave stale TLB entries XSA-286 - bsc1177412 - VUL-0: CVE-2020-27672: xen: Race condition in Xen mapping code XSA-345 - bsc1177413 - VUL-0: CVE-2020-27671: xen: undue...

CVE-2020-27672

A race condition flaw was found in the Xen code responsible for handling the updating of the hypervisor's own page tables. This flaw allows a malicious guest to cause a denial of service, host data corruption, or potential privilege escalation. The highest threat from this vulnerability is to...

ALPINE-CVE-2020-27670

An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service data corruption, cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated...

DEBIAN-CVE-2020-27670

An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service data corruption, cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated...

Oracle Database Server Database Filesystem component unauthorized access vulnerability

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. An unauthorized access vulnerability exists in the Oracle Database Server Database...

x86 PV guest INVLPG-like flushes may leave stale TLB entries

ISSUE DESCRIPTION x86 PV guest kernels may use hypercalls with INVLPG-like behavior to invalidate TLB entries even after changes to non-leaf page tables. Such changes to non-leaf page tables will, however, also render stale possible TLB entries created by Xen's internal use of linear page tables ...

undue deferral of IOMMU TLB flushes

ISSUE DESCRIPTION To efficiently change the physical to machine address mappings of a larger range of addresses for fully virtualized guests, Xen contains an optimization to coalesce per-page IOMMU TLB flushes into a single, wider flush after all adjustments have been made. While this is fine to ...

[SECURITY] Fedora 32 Update: phpMyAdmin-5.0.3-1.fc32

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields, manage privileges,export data into various formats a nd ...

CVE-2020-1679

CVE-2020-1679 affects Juniper Junos OS on PTX/QFX Series when packet sampling is configured with tunnel-observation mpls-over-udp. A malformed packet can stall the Kernel Routing Table (KRT) queue, causing forwarding issues. Affected versions (examples): 17.2X75 prior to 17.2X75-D105; 18.1R3-S11;...

[SECURITY] Fedora 33 Update: rubygem-activerecord-6.0.3.3-1.fc33

Implements the ActiveRecord pattern Fowler, PoEAA for ORM. It ties databa se tables and classes together for business objects, like Customer or Subscription, that can find, save, and destroy themselves without resorting to manual SQL...

An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions aka CID-75b0cea7bf30.

...

Denial Of Service (DoS)

Integer overflow in the gnuspecial function in libiberty allows remote attackers to cause a denial of service segmentation fault and crash via a crafted binary, related to the "demangling of virtual tables."...