GHSA-PG97-WW7H-5MJR XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode

Impact What kind of vulnerability is it? Who is impacted? Potential XSS vulnerability for users of dojox/xmpp and dojox/dtl. Patches Has the problem been patched? What versions should users upgrade to? Yes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of...

GHSA-HMR4-M2H5-33QX SQL injection in Django

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

SQL injection in Django

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

CVE-2020-6855

A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a way that exhausts system resources and results in a denial of service...

ALPINE-CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

PYSEC-2020-35

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...

Django -- potential SQL injection vulnerability

MITRE CVE reports: Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitabl...

Fedora 31 : singularity (2019-f4eb2a01d1)

Upgrade to upstream 3.5.2, still using golang-1.11 on epel8 ---- Upgrade to upstream 3.5.1, use golang-1.11 on epel8 ---- Upgrade to upstream 3.5.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempte...

rimbalinux AhadPOS 1.11 - alamatCustomer SQL Injection

rimbalinux AhadPOS 1.11 - alamatCustomer SQL Injection Exploit Title: rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection Date: 2019-11-01 Exploit Author: Cakes Vendor Homepage: https://github.com/rimbalinux/AhadPOS Software Link: https://github.com/rimbalinux/AhadPOS.git Version: 1.11 Teste...

Debian DSA-4551-1 : golang-1.11 - security update

Daniel Mandragona discovered that invalid DSA public keys can cause a panic in dsa.Verify, resulting in denial of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4551. The text itself is copyright C...

Debian: Security Advisory (DSA-4551-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4551-1] golang-1.11 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4551-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 25, 2019 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-4534-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4534-1 : golang-1.11 - security update

It was discovered that the Go programming language did accept and normalize invalid HTTP/1.1 headers with a space before the colon, which could lead to filter bypasses or request smuggling in some setups. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[SECURITY] [DSA 4534-1] golang-1.11 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4534-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 27, 2019 https://www.debian.org/security/faq -...

CVE-2019-16310

NIUSHOP V1.11 has XSS via the index.php?s=/admin URI...

Kubernetes 1.11.x < 1.11.9 / 1.12.x < 1.12.7 / 1.13.x < 1.13.5 kubectl directory traversal

The version of Kubernetes installed on the remote host is version 1.11.x prior to 1.11.9, 1.12.x prior to 1.12.7 or 1.13.x prior to 1.13.5. It is, therefore, affected by a directory traversal vulnerability in the kubectl cp command due to mishandling of symlinks when copying files from a running...

WordPress Visitor Traffic Real Time Statistics Plugin < 1.12 CSRF Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2019-14271

A flaw was discovered in Docker if it is compiled with Go 1.11. During a docker cp command, the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container. An attacker could abuse this flaw by executing code with the root privileges...

Debian DSA-4503-1 : golang-1.11 - security update (Ping Flood) (Reset Flood)

Three vulnerabilities have been discovered in the Go programming language; 'net/url' accepted some invalid hosts in URLs which could result in authorisation bypass in some applications and the HTTP/2 implementation was susceptible to denial of service. C Tenable Network Security, Inc. The...