CVE-2020-11942

Open-AudIT 3.2.2 contains SQL injection in device scripts via unsanitized parameters system.class and system.discovery_id, enabling an attacker to modify or execute arbitrary SQL statements (e.g., via crafted requests to /devices). PoC shows TRUE/FALSE payloads returning different response sizes,...

openSUSE: Security Advisory for wireshark (openSUSE-SU-2020:0362-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Wireshark Security Updates (wnpa-sec-2020-06) - Windows

Wireshark is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"; ifdescripti...

DEBIAN-CVE-2014-9720

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests...

CVE-2019-6018

Cross-site scripting vulnerability in NetCommons 3.2.2 and earlier NetCommons3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in NetCommons 3.2.2 and earlier NetCommons3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2019-14698 · Jenkins · Jenkins Spira Importer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Spira Importer Plugin versions 3.2.2 and earlier Description: The issue concerns the storage of credentials in the global configuration file on the Jenkins master. Credentials are stored unencrypted, allowing users with access to the...

NetCommons Cross-Site Scripting Vulnerability

NetCommons is an information sharing platform system. A cross-site scripting vulnerability exists in NetCommons 3.2.2 and prior versions, which stems from a lack of proper validation of client data by the WEB application and can be exploited by an attacker to execute client-side code...

OPENSUSE-SU-2019:2077-1 Security update for libmirage

This update for libmirage fixes the following issues: CVE-2019-15540: The CSO filter in libMirage in CDemu did not validate the part size, triggering a heap-based buffer overflow that could lead to root access by a local user. boo1148087 - Update to new upstream release 3.2.2 ISO parser: fixed...

CVE-2019-15540

filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user...

CloudBees Jenkins Artifactory Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Artifactory Plugin is used in one of the...

CloudBees Jenkins Artifactory Plugin Unauthorized Access Vulnerability (CNVD-2019-23826)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Artifactory Plugin is used in one of the...

Directory traversal

PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory...

PHP Scripts Mall Classified Ads Script Directory Traversal Vulnerability

PHP Scripts Mall Classified Ads Script is a classified ads script. A directory traversal vulnerability exists in PHP Scripts Mall Classified Ads Script 3.2.2. This vulnerability can be exploited to achieve directory traversal by directly requesting an uploaded directory listing...

libConfuse Memory Leak Vulnerability

libConfuse is a configuration file parser library written in C. It can be used for a variety of purposes. A memory leak vulnerability exists in the configinit file in the configure.c file in libConfuse version 3.2.2. No details of the vulnerability are provided at this time...

CVE-2018-19083

WeCenter versions 3.2.0–3.2.2 contain a cross‑site scripting (XSS) vulnerability in the template views/default/question/index.tpl.html where htmlspecialchars_decode is applied to the question_content parameter passed via /?/publish/ajax/publish_question/. The CVE entry specifies the affected comp...

Upgrade to version 3.2.2 of apache commons-collections

h3. Summary Similar to the issue described in CONFSERVER-40130, Synchrony Proxy is still using the old commons-collections library which allows for remote code execution. We can see this by looking at the following directories: code:java...

Upgrade to version 3.2.2 of apache commons-collections

h3. Summary Similar to the issue described in CONFSERVER-40130, Synchrony Proxy is still using the old commons-collections library which allows for remote code execution. We can see this by looking at the following directories: code:java...

Security Bulletin: Vulnerability in Apache Commons affects RIT and RTCP in Rational Test Workbench, RTCP and RIT Agent in Rational Test Virtualization Server, and RIT Agent in Rational Performance Test Server (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by Rational Integration Tester in Rational Test Workbench, Rational Test Control Panel in Rational Test Workbench and Rational Test Virtualization Server, and RIT Agent in Rational Test...

GitBook online reader cross-site scripting vulnerability

GitBook is a command-line tool for publishing and hosting books online. online reader is one of the online reading modules. A cross-site scripting vulnerability exists in the online reader in GitBook versions prior to 3.2.2, which stems from the program failing to properly filter user input. A...