30 matches found
Fedora 31 : 1:rubygem-rack (2020-57fc0d0156)
Update to Rack 2.0.8. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security,...
CVE-2019-16782
CVE-2019-16782 : Rack (RubyGem) contains a timing-based information disclosure vulnerability that can enable session hijacking. The flaw arises from non-constant-time handling of session IDs in the backing store, allowing an attacker to infer a valid session ID by measuring lookup times. The issu...
CVE-2019-16782 Possible Information Leak / Session Hijack Vulnerability in Rack
There's a possible information leak / session hijack vulnerability in Rack RubyGem rack. This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a...
CVE-2018-16782
libimageworsener.a in ImageWorsener 1.3.2 has a buffer overflow in the bmprreadrleinternal function in imagew-bmp.c...
CVE-2018-16782
libimageworsener.a in ImageWorsener 1.3.2 has a buffer overflow in the bmprreadrleinternal function in imagew-bmp.c...
CVE-2018-16782
CVE-2018-16782 affects libimageworsener.a in ImageWorsener 1.3.2, with a buffer overflow in the bmpr_read_rle_internal function (imagew-bmp.c). The issue is documented across multiple sources; the NVD entry confirms the vulnerability in ImageWorsener 1.3.2 and lists CVSS scores: CVSS v3.0 base sc...
CVE-2018-16782
libimageworsener.a in ImageWorsener 1.3.2 has a buffer overflow in the bmprreadrleinternal function in imagew-bmp.c...
CVE-2017-16782
In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS...
CVE-2017-16782
CVE-2017-16782 affects Home Assistant prior to 0.57. It is a cross-site scripting (XSS) vulnerability in the persistent notification rendering, where crafted Markdown text can inject JavaScript. The root cause is improper sanitization in Markdown rendering for notifications, enabling arbitrary sc...