757 matches found
SUSE-SU-2020:14394-1 Security update for microcode_ctl
This update for microcodectl fixes the following issues: Updated Intel CPU Microcode to 20200602 prerelease bsc1172466 This update contains security mitigations for: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores...
bulk-distributor.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1186732 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Mitigating vulnerabilities in endpoint network stacks
The skyrocketing demand for tools that enable real-time collaboration, remote desktops for accessing company information, and other services that enable remote work underlines the tremendous importance of building and shipping secure products and services. While this is magnified as organizations...
GHSA-6M9G-JR8C-CQW3 Depth counting error in guard() leading to multiple potential security issues in aioxmpp
Impact Possible remote Denial of Service or Data Injection. Patches Patches are available in https://github.com/horazont/aioxmpp/pull/268. They have been backported to the 0.10 release series and 0.10.3 is the first release to contain the fix. Workarounds To make the bug exploitable, an error...
CVE-2019-6477
A flaw was found in the way bind limited the number of TCP clients that can be connected at any given time. A remote attacker could use one TCP client to send a large number of DNS requests over a single connection, causing exhaustion of the pool of file descriptors available to named, and...
Security Bulletin: TLS padding vulnerability affects IBM Security Access Manager for DataPower (CVE-2014-8730)
Summary IBM Security Access Manager version 8.0.0.5 for DataPower is affected by a TLS padding vulnerability, which could allow a remote attacker to obtain sensitive information. Vulnerability Details The following vulnerability affects IBM Security Access Manager version 8.0.0.5 for DataPower...
QIWI: Remote Code Execution on contactws.contact-sys.com via SQL injection in TCertObject operation "Delete"
Summary The API interface on https://contactws.contact-sys.com:3456/ accepts a body to interact with the server's AppServ object. Because of insufficient input validation, an attacker can abuse the ID parameter to inject arbitrary SQL statements into the underlying prepared statement. This leads ...
dict.lt Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1101478 Security Researcher roker Helped patch 47 vulnerabilities Received 1 Coordinated Disclosure badges Received 4 recommendations , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting dict.lt website and its users...
ICSA-20-051-01_B&R Automation Studio and Automation Runtime
1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: B&R Industrial Automation GmbH Equipment: Automation Studio and Automation Runtime Vulnerability: Improper Authorization 2. RISK EVALUATION Successful exploitation of this vulnerability may allow a...
FreeBSD : grub2-bhyve -- multiple privilege escalations (9d6a48a7-4dad-11ea-8a1d-7085c25400ea)
Reno Robert reports : FreeBSD uses a two-process model for running a VM. For booting non-FreeBSD guests, a modified grub-emu is used grub-bhyve. Grub-bhyve executes command from guest grub.cfg file. This is a security problem because grub was never written to handle inputs from OS as untrusted. I...
Security Bulletin: Vulnerability in Apache Commons affects IBM Sterling B2B Integrator (CVE-2015-7450)
Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM Sterling B2B Integrator. Vulnerability Details CVE ID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system,...
Actionable Searching and Data Download with Vulnerability Management Dashboards
Qualys is introducing the ability to download data from your vulnerability management dashboards. With Qualys Vulnerability Management Dashboards, you can use Qualys Query Language QQL to query the data in your subscription and build vulnerability- and asset-centric dashboards that show your...
ICSA-20-035-01_AutomationDirect C-More Touch Panels
1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: AutomationDirect Equipment: C-More Touch Panels EA9 Series Vulnerability: Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an...
CVE-2019-19527
A vulnerability was found in hiddevopen in drivers/hid/usbhid/hiddev.c in the USB Human Interface Device class subsystem, where an existing device must be validated prior to its access. The device should also ensure the hiddevlist cleanup occurs at failure, as this may lead to a use-after-free...
NSA Releases Guidance on Mitigating Cloud Vulnerabilities
The National Security Agency NSA has released an information sheet with guidance on mitigating cloud vulnerabilities. NSA identifies cloud security components and discusses threat actors, cloud vulnerabilities, and potential mitigation measures. The Cybersecurity and Infrastructure Security Agenc...
divinacocina.es Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1073561 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Huawei EulerOS: Security Advisory for java-1.7.0-openjdk (EulerOS-SA-2017-1273)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
KB4534293: Windows 10 Version 1803 January 2020 Security Update
The remote Windows host is missing security update 4534293. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could...
Oracle MySQL Server cpujan2020 Multiple Security Vulnerabilities
Description Oracle MySQL Server is prone to multiple security vulnerabilities. These vulnerabilities can be exploited over 'MySQL Protocol' protocol. The 'Server: Optimizer', 'Server: Parser', 'Server: DML', and 'Server: Information Schema' components are affected. These vulnerabilities affect th...
Oracle AutoVue CVE-2020-2592 Remote Security Vulnerability
Description Oracle AutoVue is prone to a remote security vulnerability. The vulnerability can be exploited over 'HTTP' protocol. The 'Security' sub component is affected. This vulnerability affects the following supported versions: 12.0.2 Technologies Affected Oracle AutoVue 12.0.2 Recommendation...