Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
In PHP versions 7.2.x when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host …
NULL Pointer Dereference that leads to arbitrary code execution'¯in the context of the current user. (CVE-2020-9746) References: - https://bugs.mageia.org/sho…
The TCP dissector could crash (CVE-2020-25862). The MIME Multipart dissector could crash (CVE-2020-25863). The BLIP dissector could crash (CVE-2020-25866).
A vulnerability was discovered where an attacker can cause an XSS attack through the transformation feature. If an attacker sends a crafted link to the victim …
Red Hat Ansible Tower 3.6 runner release (CVE-2019-18874) 2. Description: * Updated python-psutil version to 5.6.6 inside ansible-runner container (CVE-2019-18…
Red Hat Ansible Tower 3.7 runner release (CVE-2019-18874) 2. Description: * Updated python-psutil version to 5.6.6 inside ansible-runner container (CVE-2019-18…
This update fixes CVE-2020-15180 References: - https://bugs.mageia.org/show_bug.cgi?id=27375 - https://mariadb.com/kb/en/mariadb-10325-release-notes/
Frediano Ziglio discovered multiple buffer overflow vulnerabilities in the QUIC image decoding process of spice, a SPICE protocol client and server library, wh…
In Eclipse Web Tools Platform, a component of the Eclipse IDE, XML and DTD files referring to external entities could be exploited to send the contents of loca…
A potential Cross-Site Scripting (XSS) vulnerability was found in rails, a ruby based MVC framework. Views that allow the user to control the default (not foun…
CVE-2019-11840 An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto. If more than 256 GiB of keystream is
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information…
- Update to 4.3.1 - PowerDNS Security Advisory 2020-05 (CVE-2020-17482) Release notes: https://doc.powerdns.com/authoritative/changelog/4.2.html#change-4.3.1 S…
A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick (bundled along with jruby) was too tolerant against
A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick (bundled along with ruby2.3) was too tolerant against
Red Hat Ansible Tower 3.6.6-1 - RHEL7 Container 2. Description: * Fixed an XSS vulnerability (CVE-2020-25626) * Fixed the Red Hat sosreport tool to no longer i…
When Samba is used as a domain controller, an unauthenticated attacker on the network can gain administrator access by exploiting a netlogon protocol flaw (CVE…
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with u…
AppCache manifest poisoning due to url encoded character processing (CVE-2020-12415). Use-after-free in WebRTC VideoBroadcaster (CVE-2020-12416).
Mozilla developer Jason Kratzer reported memory safety bugs present in Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume…
- Update to 4.3.1 - PowerDNS Security Advisory 2020-05 (CVE-2020-17482) Release notes: https://doc.powerdns.com/authoritative/changelog/4.2.html#change-4.3.1 S…
Several vulnerabilities were discovered in the Perl5 Database Interface (DBI). An attacker could trigger a denial-of-service (DoS) and possibly execute arbitra…
Several vulnerabilities were fixed in qt4-x11, the legacy version of the Qt toolkit. CVE-2018-15518
Several vulnerabilities were fixed in the Qt toolkit. CVE-2018-19872
