Mida eFramework version 2.8.9 suffers from a remote code execution vulnerability.
c8c3442a86453108afc78a8c318c4066965ecee2291d2821b49be30d0944428dJoplin version 1.0.245 suffers from a cross site scripting vulnerability that can lead to allowing for remote code execution.
31ca9b8599ce9c83932797054a4edb9d935327170c17b0b17e8f585827a0591eUbuntu Security Notice 4554-1 - It was discovered that libPGF lacked proper validation when opening a specially crafted PGF file. An attacker could possibly use this issue to cause a denial of service.
6d5153e654756beff626ad2eb82d2e791ca48f621d8dfcfb3cc42c74a5783dafUbuntu Security Notice 4553-1 - It was discovered that Teeworlds server did not properly handler certain network traffic. A remote, unauthenticated attacker could use this vulnerability to cause Teeworlds server to crash.
7a11e879569425a13eec2e1f66923bcca40e224fecf7d9534d42ffdbc14b6970Ubuntu Security Notice 4552-1 - Malte Kraus discovered that Pam-python mishandled certain environment variables. A local attacker could potentially use this vulnerability to execute programs as root.
15615425af77cbc41f0d9e94f0ad4a8524f300eabfc6621848fb8b81998123a7Ubuntu Security Notice 4550-1 - Ryan Hall discovered that DPDK incorrectly handled vhost crypto. An attacker inside a guest could use these issues to perform multiple attacks, including denial of service attacks, obtaining sensitive information from the host, and possibly executing arbitrary code on the host.
d8af98378677f0c95696fed25979abbe5c17bc959e6fb291f1db9dd93bd3a233Ubuntu Security Notice 4551-1 - Alex Rousskov and Amit Klein discovered that Squid incorrectly handled certain Content-Length headers. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. Amit Klein discovered that Squid incorrectly validated certain data. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. Various other issues were also addressed.
9e92ebd0c9f2c2349eaed8ad48b4f324787d866a46db0c2c35da9b6a79c5a38fUbuntu Security Notice 4547-1 - It was discovered that an information disclosure vulnerability existed in the LibVNCServer vendored in iTALC when sending a ServerCutText message. An attacker could possibly use this issue to expose sensitive information. It was discovered that the LibVNCServer and LibVNCClient vendored in iTALC incorrectly handled certain packet lengths. A remote attacker could possibly use this issue to obtain sensitive information, cause a denial of service, or execute arbitrary code. Various other issues were also addressed.
e4c50aa2b1573b7262150b8b4b002ebcb5cceb0ae668df08c6e6bc1f95f45750Ubuntu Security Notice 4548-1 - It was discovered that libuv incorrectly handled certain paths. An attacker could possibly use this issue to cause a crash or execute arbitrary code.
d01405ec577f0b65154300bc1671139dba5d4bdca797c3c731f81314edda4412Ubuntu Security Notice 4549-1 - It was discovered that ImageMagick incorrectly handled certain specially crafted image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or other unspecified impact.
f991989eee76f3bc6a01074eab8c20a59c3449a03c65cbcbe08ec8104ca8604aMSI Ambient Link Driver version 1.0.0.8 suffers from a local privilege escalation vulnerability.
d3812dcad998d0f840196864aac543b840cbaf34007890de731a2ca9e42a75b2Debian Linux Security Advisory 4758-1 - Several vulnerabilities have been discovered in the X.Org X server. Missing input sanitising in X server extensions may result in local privilege escalation if the X server is configured to run with root privileges. In addition an ASLR bypass was fixed.
f766d86a2ab873536eefe0870f0c90e55ca00d335094de674bfbccbfff6552d7Debian Linux Security Advisory 4759-1 - Fabian Vogt reported that the Ark archive manager did not sanitise extraction paths, which could result in maliciously crafted archives with symlinks writing outside the extraction directory.
e952c13ded54efaf8d191ee6b8dbf6989ef4ccc147b6b43789a9e7bfcf70434dDebian Linux Security Advisory 4760-1 - Multiple security issues were discovered in QEMU, a fast processor emulator.
9ec9643bb7edebad1c8a64c425392f1a29bfedae27d77a06866086970cb042aaDebian Linux Security Advisory 4761-1 - It was discovered that ZeroMQ, a lightweight messaging kernel library does not properly handle connecting peers before a handshake is completed. A remote, unauthenticated client connecting to an application using the libzmq library, running with a socket listening with CURVE encryption/authentication enabled can take advantage of this flaw to cause a denial of service affecting authenticated and encrypted clients.
0b04a5aaab9ee659966e2bbeb22a5b3b23c2f888e4a32faf559460daca53aaa1Debian Linux Security Advisory 4762-1 - It was discovered that the default configuration files for running the Lemonldap::NG Web SSO system on the Nginx web server were susceptible to authorisation bypass of URL access rules. The Debian packages do not use Nginx by default.
1936fc20f1fce8c046e9a32b0cf72f8389efc42588b36d32567422da6ead95deDebian Linux Security Advisory 4763-1 - It was discovered that insufficient sanitising of received network packets in the game server of Teeworlds, an online multi-player platform 2D shooter, could result in denial of service.
95fb2ad2601783836a3229eb10174e50ad7ea6799ce16534afb9523ff5a7bf41Debian Linux Security Advisory 4764-1 - Two security issues were discovered in the pgsql and mysql modules of the InspIRCd IRC daemon, which could result in denial of service.
561ab7f18ae1176cc637ced0c4ea9aa5d1f0a0587d8bdb0b528160951dbe5e8cDebian Linux Security Advisory 4765-1 - Ervin Hegedues discovered that ModSecurity v3 enabled global regular expression matching which could result in denial of service. For additional information please refer to https://coreruleset.org/20200914/cve-2020-15598/
be3b055743eb57fe9c8abc5054dbd71e1eb1dafc84281ecf5a897604f777f6a0Debian Linux Security Advisory 4766-1 - Multiple security issues were discovered in the Rails web framework which could result in cross-site scripting, information leaks, code execution, cross-site request forgery or bypass of upload limits.
b1a73047f2774964fa668a2801d5455ae63d0a6ddd6e35a8004ce02881f79bf8Debian Linux Security Advisory 4767-1 - Multiple security issues were discovered in MediaWiki, a website engine existed or not, multiple code paths lacked HTML sanitisation allowing for cross-site scripting and TOTP validation applied insufficient rate limiting against brute force attempts.
c8613614ee7c9f1ac6af0506b3a755746764aa0c99cca5c2deba55fe743bab14Debian Linux Security Advisory 4768-1 - Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting or spoofing the origin of a download.
37cc9917e4afee8359971d48c6af08486b830ce4c6dd2d0ba941a21bcc7b417aThis Metasploit module exploit uses access to the UniversalOrchestrator ScheduleWork API call which does not verify the caller's token before scheduling a job to be run as SYSTEM. You cannot schedule something in a given time, so the payload will execute as system sometime in the next 24 hours.
3a60a69dcbeb7de997adcc7d739647b41b00df07ef99e3f346dd78c5b1f47616This Metasploit module exploits an arbitrary file upload vulnerability in MaraCMS versions 7.5 and below in order to execute arbitrary commands. The module first attempts to authenticate to MaraCMS. It then tries to upload a malicious PHP file to the web root via an HTTP POST request to codebase/handler.php. If the php target is selected, the payload is embedded in the uploaded file and the module attempts to execute the payload via an HTTP GET request to this file. For the linux and windows targets, the module uploads a simple PHP web shell. Subsequently, it leverages the CmdStager mixin to deliver the final payload via a series of HTTP GET requests to the PHP web shell. Valid credentials for a MaraCMS admin or manager account are required. This module has been successfully tested against MaraCMS 7.5 running on Windows Server 2012 (XAMPP server).
46bcd0fb88548beb443fdf27155d8d4343ca495c9eb2a3289d06a46da4ac2b7bThis is a Linux/portable port of OpenBSD's excellent OpenSSH. OpenSSH is based on the last free version of Tatu Ylonen's SSH with all patent-encumbered algorithms removed, all known security bugs fixed, new features reintroduced, and many other clean-ups.
5a01d22e407eb1c05ba8a8f7c654d388a13e9f226e4ed33bd38748dafa1d2b24
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed