openSUSE Security Update : proftpd (openSUSE-2020-31)

This update for proftpd fixes the following issues : - GeoIP has been discontinued by Maxmind boo1156210 This update removes module build for geoip see https://support.maxmind.com/geolite-legacy-discontinuati on-notice/ - CVE-2019-19269: Fixed a NULL pointer dereference may occur when validating...

Adding Some Salt to Our Network – Part 2

How our configuration management actually works Following a previous post which explained why we needed a configuration management system, this post explores how we built and implemented our configuration management using SaltStack. It describes the structure of our configuration and the toolset ...

Security update for proftpd (moderate)

openSUSE Security Update: Security update for proftpd Announcement ID: openSUSE-SU-2020:0031-1 Rating: moderate References: 1113041 1144056 1154600 1155834 1156210 1157798 1157803 Cross-References: CVE-2017-7418 CVE-2019-12815 CVE-2019-18217 CVE-2019-19269 CVE-2019-19270 Affected Products: openSU...

CVE-2012-2950

Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and obtain sensitive information...

Design/Logic Flaw

Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and obtain sensitive information...

CVE-2012-2950

Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and obtain sensitive information...

CVE-2012-2950

CVE-2012-2950 affects Gateway Geomatics MapServer for Windows (MS4W). The vulnerability is a Local File Inclusion in the bundled Apache/PHP configuration that allows remote attackers to view arbitrary files and execute PHP code with SYSTEM privileges. Affected releases are the MS4W packages up to...

CVE-2012-2950: Unrestricted Upload of File with Dangerous Type

Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and obtain sensitive information...

PT-2020-7212

Name of the Vulnerable Software and Affected Versions Gateway Geomatics MapServer for Windows versions prior to 3.0.6 Description The issue allows remote attackers to execute local PHP code and obtain sensitive information due to a Local File Include Vulnerability. Recommendations For versions...

CVE-2019-19769: Use After Free

In the Linux kernel 5.3.10, there is a use-after-free read in the perftracelockacquire function related to include/trace/events/lock.h...

CVE-2019-19602

fpregsstatevalid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service memory corruption or possibly have unspecified other impact because of incorrect fpufpregsownerctx caching, as demonstrated...

CVE-2019-19602: Improper Restriction of Operations within the Bounds of a Memory Buffer

fpregsstatevalid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service memory corruption or possibly have unspecified other impact because of incorrect fpufpregsownerctx caching, as demonstrated...

CVE-2019-19018: Files or Directories Accessible to External Parties

An issue was discovered in TitanHQ WebTitan before 5.18. It exposes a database configuration file under /include/dbconfig.ini in the web administration interface, revealing what database the web application is using...

PT-2019-15759

Name of the Vulnerable Software and Affected Versions TitanHQ WebTitan versions prior to 5.18 Description An issue in the web administration interface exposes a database configuration file under /include/dbconfig.ini, revealing the database used by the web application. Recommendations For version...

Command injection

A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/formMibs.php. This page is called from the Centreon administration interface. This is the mibs management feature that contains a file filin...

CVE-2019-15300

A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldaphost.php. The arId parameter is not properly filtered before being passed to the SQL query...

CVE-2019-10765

iobroker.admin before 3.6.12 allows attacker to include file contents from outside the /log/file1/ directory...

tomcat: XSS in SSI printenv

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

tomcat: XSS in SSI printenv

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

PT-2019-12037

Name of the Vulnerable Software and Affected Versions iobroker.admin versions prior to 3.6.12 Description The issue allows an attacker to include file contents from outside the intended directory due to a path traversal problem. The package fails to restrict access to folders outside of the...