PT-2020-14160

Name of the Vulnerable Software and Affected Versions DIGITUS DA-70254 4-Port Gigabit Network Hub version 2.073.000.E0008 Description The issue allows an attacker on the same network to cause a denial-of-service of the device by sending long input values. Recommendations For version...

PT-2020-14156

Name of the Vulnerable Software and Affected Versions Lindy 42633 4-Port USB 2.0 Gigabit Network Server version 2.078.000 Description The device is susceptible to a denial-of-service attack when an attacker on the same network sends long input values. Recommendations For version 2.078.000, consid...

Denial Of Service (DoS)

python is vulnerable to denial of service DoS. The vulnerability exists as Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the...

CloudForms: CSV Injection in Orchestration Templates

A flaw was found in Orchestration Template of Red Hat CloudForms where a low privilege user could enter crafted CSV formulae. Successful exploitation will allow an attacker to execute arbitrary code with the privilege of currently logged in user of the system causing serious damage to the victim’...

Hyperledger: Vulnerabilities in Endorsement Mechanism of Private Data Related Transactions in Hyperledger Fabric 2.0

To whom it may concern, We report design flaws that can be exploited by private data collection non-member organizations to forge endorsements of read-related transactions and return fake values to a user. When a user issues a read-only transaction proposal to a endorser in the private data...

CVE-2020-16271: Use of Insufficiently Random Values

The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data in the KeePass database via a WebSocket connection...

PT-2020-21900

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN WRITE. The crash state involves several function calls, including hb vector t::resize, hb vector t::push, a...

PT-2020-21893

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN WRITE. The crash state involves several function calls, including hb vector t::resize, hb vector t::push, a...

CVE-2020-16166: Use of Insufficiently Random Values

The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c...

CVE-2019-20026

The WebPro interface in NEC SV9100 software releases 7.0 or higher allows unauthenticated remote attackers to reset all existing usernames and passwords to default values via a crafted request...

CVE-2019-20026

The WebPro interface in NEC SV9100 software releases 7.0 or higher allows unauthenticated remote attackers to reset all existing usernames and passwords to default values via a crafted request...

OSV-2020-1486 Bad-cast to Sass::PreValue from Sass::Unary_Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15896 Crash type: Bad-cast Crash state: Bad-cast to Sass::PreValue from Sass::UnaryExpression Sass::SharedImpl::SharedImpl Sass::Parser::parsevalueschema...

PT-2020-19718 · None · Uvicorn

Name of the Vulnerable Software and Affected Versions: Uvicorn versions prior to 0.11.7 Description: The issue allows attackers to exploit HTTP response splitting by adding arbitrary headers to HTTP responses or returning an arbitrary response body when crafted input is used to construct HTTP...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Python vulnerabilities (USN-4428-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4428-1 advisory. It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong...

PT-2020-21712

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow WRITE crash has been reported, involving the functions rt read handler, sav read variable missing values, and sav read variable...

CVE-2020-3345 Cisco Webex Meetings and Cisco Webex Meetings Server HTML Injection Vulnerability

A vulnerability in certain web pages of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to modify a web page in the context of a browser. The vulnerability is due to improper checks on parameter values within affected pages. An attacker could...

CVE-2020-4316

IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecu...

PT-2020-17896

Name of the Vulnerable Software and Affected Versions IBM Guardium Activity Insights versions 10.6 through 11.0 Description The issue allows attackers to obtain cookie values by sending a http link to a user or by planting this link in a site the user visits. The cookie will be sent to the insecu...

CVE-2020-15095

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "://:@::/". The password value is not redacted and is printed to stdout and also to any generated log files...

OPENSUSE-SU-2020:0940-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2020-14422: Fixed an improper computation of hash values in the IPv4Interface and IPv6Interface could have led to denial of service bsc1173274. This update was imported from the SUSE:SLE-15:Update update project...