{"vulnerability": "CVE-2020-2938", "sightings": [{"uuid": "a7e7b2d6-0820-4ed9-b2da-dba5b40e0f41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29385", "type": "seen", "source": "https://t.me/cibsecurity/21317", "content": "\u203c CVE-2020-29385 \u203c\n\nGNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-26T07:26:37.000000Z"}, {"uuid": "1ed0722e-10e6-4a3f-8700-111600771694", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29389", "type": "seen", "source": "https://t.me/cibsecurity/17044", "content": "\u203c CVE-2020-29389 \u203c\n\nThe official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user. System using the Crux Linux Docker container deployed by affected versions of the Docker image may allow an attacker to achieve root access with a blank password.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-02T20:55:14.000000Z"}, {"uuid": "fe4e4418-558f-43bf-b671-0260f8672794", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29382", "type": "seen", "source": "https://t.me/cibsecurity/16919", "content": "\u203c CVE-2020-29382 \u203c\n\nAn issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. A hardcoded RSA private key (specific to V1600D, V1600G1, and V1600G2) is contained in the firmware images.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-29T07:51:33.000000Z"}, {"uuid": "27a149ee-d7fe-4488-adc2-e0871674ff76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29381", "type": "seen", "source": "https://t.me/cibsecurity/16916", "content": "\u203c CVE-2020-29381 \u203c\n\nAn issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. Command injection can occur in \"upload tftp syslog\" and \"upload tftp configuration\" in the CLI via a crafted filename.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-29T07:51:31.000000Z"}, {"uuid": "77621ac4-0bc3-4a3e-8b57-597539028d49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29383", "type": "seen", "source": "https://t.me/cibsecurity/16918", "content": "\u203c CVE-2020-29383 \u203c\n\nAn issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. A hardcoded RSA private key (specific to V1600D4L and V1600D-MINI) is contained in the firmware images.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-29T07:51:33.000000Z"}, {"uuid": "b36b6abf-c018-4a47-9085-31ca9fe1d070", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-29380", "type": "seen", "source": "https://t.me/cibsecurity/16917", "content": "\u203c CVE-2020-29380 \u203c\n\nAn issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. TELNET is offered by default but SSH is not always available. An attacker can intercept passwords sent in cleartext and conduct a man-in-the-middle attack on the management of the appliance.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-29T07:51:32.000000Z"}]}