Linux Kernel any version

IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 211402.

IBM Qradar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196073.

IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339.

wifi: wilc1000: fix RCU usage in connect path

OS Command Injection in IBM Aspera Faspex

net/mlx5: Properly link new fs rules into the tree

netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid authentication token. Successful exploitation of this issue would result in the attacker being able to view and alter administrative configuration settings.

netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

wifi: mac80211: don't return unset power in ieee80211_get_tx_power()

bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself

wifi: iwlwifi: dbg-tlv: ensure NUL termination

An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read.

An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read.

Path Traversal in parisneo/lollms-webui

An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate.

In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. NOTE: this is disputed because the code path is unreachable

Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 236584."

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

drm/amd/display: Avoid HDCP over-read and corruption

IBM Security Guardium Key Lifecycle Manager directory traversal

USB: core: Fix access violation during port device removal

tipc: Return non-zero value from tipc_udp_addr2str() on error

cifs: potential buffer overflow in handling symlinks

bridge: br_nd_send: linearize skb before parsing ND options

netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

OS command injection in IBM Aspera Faspex

browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy.

smack: tcp: ipv4, fix incorrect labeling

A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored.

nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

netlabel: fix out-of-bounds memory accesses

sctp: validate embedded INIT chunk and address list lengths in cookie

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.

ocfs2/dlm: validate qr_numregions in dlm_match_regions()

RDMA/srp: bound SRP_RSP sense copy by the received length

dcache: Limit the minimal number of bucket to two

sctp: fix uninit-value in __sctp_rcv_asconf_lookup()