openSUSE: Security Advisory for libexif (openSUSE-SU-2020:0793-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : libexif (openSUSE-2020-793)

This update for libexif to 0.6.22 fixes the following issues : Security issues fixed : - CVE-2016-6328: Fixed an integer overflow in parsing MNOTE entry data of the input file bsc1055857. - CVE-2017-7544: Fixed an out-of-bounds heap read vulnerability in exifdatasavedataentry function in...

Security update for libexif (moderate)

openSUSE Security Update: Security update for libexif Announcement ID: openSUSE-SU-2020:0793-1 Rating: moderate References: 1055857 1059893 1120943 1160770 1171475 1171847 1172105 1172116 1172121 Cross-References: CVE-2016-6328 CVE-2017-7544 CVE-2018-20030 CVE-2019-9278 CVE-2020-0093 CVE-2020-127...

CVE-2020-8792

The CVE-2020-8792 entry concerns the OKLOK 3.1.1 mobile companion app for the Fingerprint Bluetooth Padlock FB50 (2.3), where an information-disclosure flaw allows an attacker to learn arbitrary users’ emails and lock names by supplying valid, guessable barcodes through the app interface. Technic...

CVE-2020-5290

In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the token=$ssid hash when making a request to the /verify endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that victim...

CVE-2011-1086

Cross-site scripting XSS vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter...

CVE-2011-1086

Cross-site scripting XSS vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter...

CVE-2011-1086

CVE-2011-1086 is an XSS vulnerability in Openfiler 2.3, affecting the admin/system.html page and exploitable via the device parameter to inject arbitrary script/HTML. The connected documents corroborate the issue across sources (NVD, Red Hat, CVE records, CNVD, etc.). The available materials do n...

Authentication flaw

SimpleHRM 2.3 and earlier could allow remote attackers to bypass the authentication process in 'usermanager.php' via spoofing a cookie...

python-reportlab security update

2.3-3.el610.1 - Do not eval strings passed to toColor - Resolves: 1788551...

[SECURITY] [DSA 4587-1] ruby2.3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4587-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 17, 2019 https://www.debian.org/security/faq -...

DSA-4587-1 ruby2.3 - security update

Bulletin has no description...

CVE-2019-4095

CVE-2019-4095 affects IBM Cloud Pak System 2.3 (including 2.3.0.1) and is due to a cross-site request forgery that could allow an attacker to perform malicious, unauthorized actions on behalf of a trusted user. IBM X-Force ID: 158015. The IBM Security Bulletin confirms the vulnerability and lists...

IBM Cloud Pak System Cross-Site Request Forgery Vulnerability

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. A cross-site request forgery vulnerability exists in IBM Cloud Pak System...

CVE-2019-4467

IBM Cloud Pak System Platform System Manager (Cloud Pak System) is affected by CVE-2019-4467, with vulnerable versions 2.3 and 2.3.0.1. The issue is a cross-site scripting (XSS) vulnerability in the Web UI that can allow an attacker to embed arbitrary JavaScript, potentially leading to credential...

CVE-2019-4098

CVE-2019-4098 affects IBM Cloud Pak System 2.3 and 2.3.0.1, with a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. The IBM advisory (and related IBM X-Force reference) confir...

IBM Cloud Pak System Platform System Manager Cross-Site Scripting Vulnerability

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. A cross-site scripting vulnerability exists in Platform System Manager in IBM...

IBM Cloud Pak System Cross-Site Scripting Vulnerability (CNVD-2019-44556)

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. A cross-site scripting vulnerability exists in IBM Cloud Pak System versions 2...

IBM Cloud Pak System Platform System Manager Information Disclosure Vulnerability

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. An information disclosure vulnerability exists in Platform System Manager in I...

IBM Cloud Pak System CVE-2019-4098 Cross Site Scripting Vulnerability

Description IBM Cloud Pak System is prone to an cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication...