CVE-2019-3799

The CVE-2019-3799 entries describe a Local File Inclusion/Directory Traversal vulnerability in Spring Cloud Config Server. Affected versions are Spring Cloud Config Server 2.1.x before 2.1.2, 2.0.x before 2.0.4, and 1.4.x before 1.4.6, plus older unsupported releases. An unauthenticated attacker ...

EulerOS 2.0 SP3 : python (EulerOS-SA-2019-1337)

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop method. An...

EulerOS 2.0 SP3 : openssl110f (EulerOS-SA-2019-1328)

According to the version of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value...

EulerOS 2.0 SP5 : python-paramiko (EulerOS-SA-2019-1339)

According to the version of the python-paramiko package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can...

EulerOS 2.0 SP5 : openssh (EulerOS-SA-2019-1324)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle...

Input validation

A vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 Single Sign-On SSO for Clientless SSL VPN WebVPN and AnyConnect Remote Access VPN in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated,...

CVE-2019-1714

CVE-2019-1714 affects Cisco ASA and Cisco Firepower Threat Defense (FTD) software, where the SAML 2.0 SSO implementation has improper credential handling for NTLM or basic authentication. An unauthenticated, remote attacker could open a VPN session after another user has authenticated via SAML SS...

Denial Of Service (DoS)

modauthmellon provides a SAML 2.0 authentication module for the Apache HTTP Server. An information disclosure flaw was found in modauthmellon's session handling that could lead to sessions overlapping in memory. A remote attacker could potentially use this flaw to obtain data from another user's...

Cross Site Scripting (XSS)

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2012-1948,...

Arbitrary Code Execution

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2012-1948,...

Fedora 30 : mxml (2019-4182dd32eb)

Update to 3.0. License has changed to ASL 2.0 + exception. See https://github.com/michaelrsweet/mxml/releases/tag/v3.0 for more info. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2019-1315)

According to the version of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A null pointer dereference vulnerability exists in the xpath function of libxml2 when parsing invalid XPath expression. Applications processing...

EulerOS 2.0 SP3 : libvirt (EulerOS-SA-2019-1314)

According to the version of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intende...

EulerOS 2.0 SP3 : libssh2 (EulerOS-SA-2019-1309)

According to the versions of the libssh2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out of bounds read flaw was discovered in libssh2 when a specially crafted SFTP packet is received from the server. A remote attacker who...

EulerOS 2.0 SP3 : libtasn1 (EulerOS-SA-2019-1312)

According to the version of the libtasn1 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Two errors in the 'asn1findnode' function lib/parseraux.c within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer...

EulerOS 2.0 SP5 : libssh2 (EulerOS-SA-2019-1310)

According to the versions of the libssh2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out of bounds read flaw was discovered in libssh2 when a specially crafted SFTP packet is received from the server. A remote attacker who...

EulerOS 2.0 SP3 : mod_auth_mellon (EulerOS-SA-2019-1320)

According to the versions of the modauthmellon package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - modauthmellon: authentication bypass in ECP flow CVE-2019-3878 - modauthmellon: open redirect in logout url when using URLs with backslash...

EulerOS 2.0 SP2 : libtasn1 (EulerOS-SA-2019-1311)

According to the version of the libtasn1 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Two errors in the 'asn1findnode' function lib/parseraux.c within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer...

EulerOS 2.0 SP3 : libpng (EulerOS-SA-2019-1307)

According to the version of the libpng packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The pngsettext2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allow...

EulerOS 2.0 SP3 : elfutils (EulerOS-SA-2019-1281)

According to the versions of the elfutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An Invalid Memory Address Dereference exists in the function elfend in libelf in elfutils through v0.174. Although eu-size is intended to...