CVE-2019-13144

myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5...

CVE-2019-13144

myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5...

Debian DLA-1749-1 : golang security update

It was discovered that there was a CRLF injection attack in the Go programming language runtime library. Passing \r\n to http.NewRequest could allow execution of arbitrary HTTP headers or Redis commands. For Debian 8 'Jessie', this issue has been fixed in golang version 2:1.3.3-1+deb8u2. We...

Security Bulletin: Vulnerabilities in SSLv3 affect IBM Flex System Manager (FSM) SMIA Configuration Tool (CVE-2014-3513, CVE-2014-3566, CVE-2014-3567, CVE-2014-3568)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack and other vulnerabilities. SSLv3 is enabled in IBM FSM SMIA Configuration Tool commonly referred to as Network Advisor has addressed the applicable CVEs...

CloudBees Pipeline Declarative Plugin Sandbox Bypass Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , the tool is mainly used to monitor the order of repetitive work . Pipeline: Declarative Plugin is used in one of the command generator plugin...

GHSA-7X9J-7223-RG5M Improper Access Control in commons-fileupload

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution...

Updated kdeconnect-kde packages fix security vulnerability

The kdeconnect-kde package has been updated to version 1.3.3, which fixes an issue with modern encryption algorithms being disabled with SSH, and also fixes several bugs and updates compatibility with the Android app...

CVE-2018-19424

ClipperCMS 1.3.3 allows remote authenticated administrators to upload .htaccess files...

CVE-2018-19424

ClipperCMS 1.3.3 allows remote authenticated administrators to upload .htaccess files...

CVE-2018-19424

ClipperCMS 1.3.3 allows remote authenticated administrators to upload .htaccess files...

ClipperCMS 1.3.3 - Cross-Site Request Forgery (File Upload)

Exploit Title: ClipperCMS 1.3.3 File Upload CSRF Vulnerability Date: 2018-11-11 Exploit Author: Ameer Pornillos Website: http://ethicalhackers.club Vendor Homepage: http://www.clippercms.com/ Software Link: https://github.com/ClipperCMS/ClipperCMS/releases/tag/clipper1.3.3 Version: 1.3.3 Tested o...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Operations Analytics Predictive Insights (CVE-2018-1621)

Summary Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin:...

zip4j directory traversal vulnerability

zip4j is a Java-based library for compression/decompression . A directory traversal vulnerability exists in zip4j versions prior to 1.3.3. The vulnerability can be exploited to write arbitrary files with a specially crafted zip archive file with a directory traversal name...

Cross site scripting

ClipperCMS 1.3.3 has stored XSS via the Full Name field of 1 Security - Manager Users or 2 Security - Web Users...

CVE-2018-13106

ClipperCMS 1.3.3 has stored XSS via the "Tools - Configuration" screen of the manager/ URI...

DEBIAN-CVE-2018-1000559

qutebrowser version introduced in v0.11.0 1179ee7a937fb31414d77d9970bac21095358449 contains a Cross Site Scripting XSS vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be...

Cross site scripting

On D-Link DIR-620 devices with a certain customized by ISP variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, a reflected Cross-Site Scripting XSS attack is possible as a result of missed filtration for special characters in the "Search" field and incorrect processing of t...

CVE-2018-6212

On D-Link DIR-620 devices with a certain customized by ISP variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, a reflected Cross-Site Scripting XSS attack is possible as a result of missed filtration for special characters in the "Search" field and incorrect processing of t...

Security Bulletin: Vulnerability in Apache Commons FileUpload DiskFileItem File Manipulation affects IBM Platform Symphony, IBM Spectrum Symphony (CVE-2016-1000031)

Summary A security vulnerability relating to remote code execution CVE-2016-1000031 has been reported against Apache Commons FileUpload DiskFileItem File Manipulation, which IBM Platform Symphony uses as a framework for its WEBGUI service. The Commons FileUpload version that is vulnerable to thes...

Security Bulletin: IBM Flex System Manager (FSM) is affected by a giflib vulnerability (CVE-2016-3977)

Summary A security vulnerability has been discovered in giflib that is embedded in the IBM FSM. This bulletin addresses this vulnerability Vulnerability Details CVEID: CVE-2016-3977 DESCRIPTION: giflib is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by...