Linux: Strictly define variable LD_LIBRARY_PATH

Check whether variable LDLIBRARYPATH or any equivalent variable exists in the user environmentroot or other environments. If yes, the variable should refer to the /lib, /usr/lib, /var/lib, /usr/X11R6/lib library only. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be...

glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries

A vulnerability was discovered in glibc where the LDPREFERMAP32BITEXEC environment variable is not ignored when running binaries with the setuid flag on x8664 architectures. This allows an attacker to force system to utilize only half of the memory making the system think the software is 32-bit...

kernel: buffer-overflow hardening in WiFi beacon validation code.

A flaw in the Linux kernel's WiFi beacon validation code was discovered. The code does not check the length of the variable length elements in the beacon head potentially leading to a buffer overflow. System availability, as well as data confidentiality and integrity, can be impacted by this...

wavpack: Use of uninitialized variable in ParseCaffHeaderConfig leads to DoS

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig caff.c:486. The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit...

wavpack: Use of uninitialized variable in WavpackSetConfiguration64 leads to DoS

WavpackSetConfiguration64 in packutils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service application crash via a DFF file that lacks valid sample-rate data...

wavpack: Use of uninitialized variable in ParseWave64HeaderConfig leads to DoS

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig wave64.c:211. The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit...

WebKit AudioArray::allocate Data Race / Out-Of-Bounds Access

WebKit: Data race in AudioArray::allocate can lead to OOB access VULNERABILITY DETAILS Source/WebCore/platform/audio/AudioArray.h: void allocateChecked n ... while !isAllocationGood // Initially we try to allocate the exact size, but if it's not aligned // then we'll have to reallocate and from...

Ansible: code injection when using ansible_facts as a subkey

A flaw was found in the Ansible Engine. When using ansiblefacts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansiblefacts after the clean, an attacker could take advantage of this by altering the ansiblefacts leading to privilege escalation or...

Ansible: code injection when using ansible_facts as a subkey

A flaw was found in the Ansible Engine. When using ansiblefacts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansiblefacts after the clean, an attacker could take advantage of this by altering the ansiblefacts leading to privilege escalation or...

Scientific Linux Security Update : cups on 7.x i686/x86_64 (2020:1050)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2020:1050-1 advisory. - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. CVE-2018-4180,...

CVE-2020-11944

Abe aka bitcoin-abe through 0.7.2, and 0.8pre, allows XSS in call in abe.py because the PATHINFO environment variable is mishandled during a PageNotFound exception...

CVE-2020-11944

Abe aka bitcoin-abe through 0.7.2, and 0.8pre, allows XSS in call in abe.py because the PATHINFO environment variable is mishandled during a PageNotFound exception...

Lk Scraper - An Fully Configurable Linkedin Scrape (Scrape Anything Within Linkedin)

Scrapes Any Linkedin Data Installation $ pip install git+git://github.com/jqueguiner/lkscraper Setup Using Docker compose $ docker-compose up -d $ docker-compose run lkscraper python3 Using Docker only forselenium server First, you need to run a selenium server $ docker run -d -p 4444:4444...

CVE-2019-20785

An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier. RILD in the radio layer uses an uninitialized variable. The LG ID is LVE-SMP-180013 January 2019...

CVE-2019-20785

An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier. RILD in the radio layer uses an uninitialized variable. The LG ID is LVE-SMP-180013 January 2019...

Design/Logic Flaw

An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier. RILD in the radio layer uses an uninitialized variable. The LG ID is LVE-SMP-180013 January 2019...

CVE-2019-20785

CVE-2019-20785 affects LG mobile devices running Android 8.0/8.1 for the DTAG carrier. The issue is in RILD (radio interface layer) where an uninitialized variable is used, per the Red Hat and NVD entries. LG’s internal ID is LVE-SMP-180013 (January 2019). Public details are limited in the provid...

CVE-2019-20785

An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier. RILD in the radio layer uses an uninitialized variable. The LG ID is LVE-SMP-180013 January 2019...

CVE-2016-1000107

A flaw was found in the Inets application in Erlang version 22.1 and possibly earlier, where it follows RFC 3875 section 4.1.18 and does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable. This flaw allows remote attackers to redirect an...

ZSQL: Audit File Path

The LOGHOME parameter specifies the storage path of the audit file. By default, the audit file is stored in the $GSDBDATA/log/audit directory. Note: The script compares the LOGHOME in DVPARAMETERS with the $GSDBDATA/log environmental variable. SPDX-FileCopyrightText: 2020 Greenbone AG Some text...