CVE-2020-11812

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters0value or filters1value parameter...

CVE-2020-11813

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

Security Bulletin: IBM QRadar Advisor With Watson App for IBM QRadar SIEM is vulnerable to information exposure (CVE-2019-4672)

Summary IBM QRadar Advisor with Watson App for IBM QRadar SIEM could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in further attacks against the system. Vulnerability Details CVEID: CVE-2019-4672 DESCRIPTION: IBM QRadar Advisor...

Design/Logic Flaw

openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file...

Security update for rmt-server (important)

openSUSE Security Update: Security update for rmt-server Announcement ID: openSUSE-SU-2020:0235-1 Rating: important References: 1141122 1157119 1160673 1160922 Cross-References: CVE-2019-18904 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has three fixes is now...

Security feature bypass

YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability...

CVE-2013-2057

YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability...

SUSE SLES15 Security Update : rmt-server (SUSE-SU-2020:0260-1)

This update for rmt-server to version 2.5.2 fixes the following issues : Security issue fixed : CVE-2019-18904: Fixed a denial of service in the offline migration bsc1160922. Non-security issue fixed : Relaxed systemd units dependencies bsc1160673 Added more verbose error reporting for SCC API...

Huawei EulerOS: Security Advisory for libtasn1 (EulerOS-SA-2019-1082)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2018-1413)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for gnupg2 (EulerOS-SA-2019-1077)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rukovoditel Project Management CRM 2.5.2 SQL Injection

Exploit Title: Rukovoditel Project Management CRM 2.5.2 - 'reportsid' SQL Injection Google Dork: N/A Date: 2020-01-15 Blog: https://fatihhcelik.blogspot.com/ Exploit Author: Fatih Çelik Vendor Homepage: https://www.rukovoditel.net/ Software Link: https://sourceforge.net/projects/rukovoditel/...

Debian DLA-1976-1 : imapfilter security update

The imapfilter tool, a utility for scripting IMAP operations in lua, lacked server name / certificate peer hostname validation support. For Debian 8 'Jessie', this problem has been fixed in version 1:2.5.2-2+deb8u1. We recommend that you upgrade your imapfilter packages. NOTE: Tenable Network...

TYPO3 freeCap CAPTCHA Input Validation Error Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. freeCap CAPTCHA is used in one of the CAPTCHA extension plugins. A security vulnerability exists in TYPO3 freeCap CAPTCHA version 2.4.5 and earlier and version 2.5.2 and earlier...

[SECURITY] [DLA 1909-1] freetype security update

Package : freetype Version : 2.5.2-3+deb8u4 CVE ID : CVE-2015-9381 CVE-2015-9382 CVE-2015-9383 Several newly-referenced issues have been fixed in the FreeType 2 font engine. CVE-2015-9381 heap-based buffer over-read in T1GetPrivateDict in type1/t1parse.c CVE-2015-9382 buffer over-read in...

openSUSE Security Update : singularity (openSUSE-2019-811)

Singularity was updated to version 2.6.0, bringing features, bugfixes and security fixes. Security issues fixed : - CVE-2018-12021: Fixed access control on systems supporting overlay file system boo1100333. Highlights of 2.6.0 : - Allow admin to specify a non-standard location for mksquashfs bina...

Important: ruby23, ruby24

Issue Overview: An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first...

PT-2018-2985 · Openssl +6 · Openssl +6

Name of the Vulnerable Software and Affected Versions: Ruby versions prior to 2.3.8 Ruby versions 2.4.x prior to 2.4.5 Ruby versions 2.5.x prior to 2.5.2 Ruby versions 2.6.x prior to 2.6.0-preview3 Description: The issue is related to the comparison of two OpenSSL::X509::Name objects using the ==...

Fedora 27 : singularity (2018-abe4d2383e)

This is a straightforward update from 2.5.1 to the newly-released 2.5.2. Release notes are here : https://github.com/singularityware/singularity/releases/tag/2.5.2 The most important fix is a security issue in the overlay code. Please look for regressions in your Singularity runtime workflows. No...

last_run_report.yaml is world readable

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for lastrunreport.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file...