Debian DLA-2167-1 : python-bleach security update

A vulnerability was discovered in python-bleach, a whitelist-based HTML-sanitizing library. Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to a regular expression denial of service ReDoS. For Debian 8 'Jessie', this problem has been fixed in version...

Dreamcms v1.4 (lmxcms) file upload vulnerability in the background

Dream Cms, hereinafter referred to as "lmxcms", is a simple and practical website management system cms developed by "10 years" screen name, completely free and open source. Dream cms v1.4 lmxcms file upload vulnerability in the background, attackers can use the vulnerability to obtain web server...

Cross site request forgery (csrf)

An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lac...

CVE-2020-7988

An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lac...

Design/Logic Flaw

An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a...

CVE-2019-3998

Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to modify the Wi-Fi network the base station connects to...

Authentication flaw

Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to modify the Wi-Fi network the base station connects to...

CVE-2012-6306

A vulnerability exists in HCView aka Hardcoreview 1.4 due to a write access violation with a GIF file...

Design/Logic Flaw

A vulnerability exists in Arctic Torrent 1.4 via unspecified vectors in .torrent file handling, which could let a malicious user cause a Denial of Service...

CVE-2012-6309

A vulnerability exists in Arctic Torrent 1.4 via unspecified vectors in .torrent file handling, which could let a malicious user cause a Denial of Service...

CVE-2012-6306

CVE-2012-6306 affects HCView (aka Hardcoreview) 1.4. The vulnerability is caused by a write access violation triggered by a GIF file. Concrete details specified in connected documents identify the affected product and the root cause as a GIF-processing write violation, but no remediation or explo...

CVE-2020-6059

An exploitable out of bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. A specially crafted SNMP request can trigger an out of bounds memory read which can result in sensitive information disclosure and Denial Of Service. In order to trigger this...

Oracle Primavera Unifier Multiple Vulnerabilities (Jan 2020 CPU)

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.1.x or 16.2.x prior to 16.2.16.0, or 17.7.x through 17.12.x prior to 17.12.11.2, or 18.8.x prior to 18.8.15, or 19.12.x prior to 19.12.0.1. It is, therefore, affected by...

Oracle Tuxedo Remote Code Execution Vulnerability (Jan 2020 CPU)

The version of Oracle Tuxedo installed on the remote host is missing a security patch. It is, therefore, affected by a remote code execution vulnerability due to a Server Side Request Forgery SSRF vulnerability found in the Apache Axis 1.4 distribution used in the TX SALT component. %NASLMINLEVEL...

Design/Logic Flaw

Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering...

CVE-2019-12186

An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through...

PT-2019-6411 · Graphicsmagick +1 · Graphicsmagick +1

Name of the Vulnerable Software and Affected Versions: GraphicsMagick version 1.4 Description: The issue is related to a Buffer Overflow vulnerability in the WritePCXImage function in pcx.c, which allows remote attackers to cause a denial of service via converting a crafted image file to pcx...

PT-2019-5246 · Graphicsmagick +3 · Graphicsmagick +3

Name of the Vulnerable Software and Affected Versions: GraphicsMagick versions 1.4 snapshot-20190423 Q8 Description: The issue is related to a heap-based buffer overflow in the ImportRLEPixels function, which can be exploited by a remote attacker to gain unauthorized access to information,...

CVE-2012-2237

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 javascript innerHTML as used when generating login forms, 2 links or 3 resources URLs, and 4 the Display nam...

CKEditor Information Disclosure Vulnerability

Drupal is an open source content management system developed by the Drupal community using the PHP language.CKEditor is one of the WYSIWYG editor modules used in... An information disclosure vulnerability exists in CKEditor version 7.x-1.4 for Drupal. The vulnerability stems from errors such as...