CVE-2020-11807

Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code and sometimes terminal commands on a server by making an avatar update and then visiting the avatar file under the /images/ path...

CVE-2020-11807

Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code and sometimes terminal commands on a server by making an avatar update and then visiting the avatar file under the /images/ path...

[SECURITY] Fedora 32 Update: php-symfony4-4.4.7-1.fc32

Symfony PHP framework version 4. NOTE: Does not require PHPUnit bridge...

CVE-2020-5255

In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the...

CVE-2020-5275

In Symfony, the security-http component had a fault in Firewall access checks prior to versions 4.4.7 and 5.0.7 where the system iterated rule attributes and stopped after the first granted attribute, bypassing remaining checks under an unanimous strategy. The issue is resolved by changing the ac...

CVE-2020-5255 Prevent cache poisoning via a Response Content-Type header

In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the...

PT-2020-18365 · Symfony · Symfony Security Http

Name of the Vulnerable Software and Affected Versions: symfony/security-http versions 4.4.0 through 4.4.6 symfony/security-http versions 5.0.0 through 5.0.6 Description: The issue arises when a Firewall checks access control rules using the unanimous strategy. In affected versions, the Firewall...

CVE-2017-16558

Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20190226)

Security Fixes : - kernel: MIDI driver race condition leads to a double-free CVE-2018-10902 Bug Fixes : - Previously backported upstream patch caused a change in the behavior of page fault handler. As a consequence, applications compiled through GNU Compiler Collection GCC version 4.4.7 sometimes...

Kamailio 'tmx_check_pretran' function buffer overflow vulnerability

Kamailio is an open source GPL-based SIP Session Initiation Protocol server developed by the FhG FOKUS Institute in Germany. A buffer overflow vulnerability exists in the 'tmxcheckpretran' function in the modules/tmx/tmxpretran.c file in Kamailio versions prior to 4.4.7, 5.0.x versions prior to...

DEBIAN-CVE-2018-8828

A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmxcheckpretran function in modules/tmx/tmxpretran.c...

CVE-2017-5799

A Remote Code Execution vulnerability in HPE OpenCall Media Platform OCMP was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 for OCMP 3.x, all versions prior to 4.4.7 RP702 for OCMP 4.x...

Fedora 23 : kernel-4.4.7-300.fc23 (2016-8e858f96b8)

The 4.4.7 update contains a number of important fixes across the kernel tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Wing FTP 4.4.6 Cross Site Request Forgery

Exploit Title: Wing FTP Server Cross-site Request Forgery vulnerabilities Product: Wing FTP Server Vulnerable Versions: 4.4.6 and all previous versions Tested Version: 4.4.6 Advisory Publication: 05/06/2015 Latest Update: 05/06/2015 Vulnerability Type: Cross-site Request Forgery CWE-352 CVE...

Bugzilla < 4.0.16 / 4.1.1 < 4.2.12 / 4.3 < 4.4.7 / 4.5 < 4.5.6 Command Injection

Binary data 8913.prm...

Fortinet FortiWeb Multiple Vulnerabilities (FG-IR-13-009)

Fortinet FortiWeb is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:fortinet:fortiweb"; if...

PHP <= 5.2.3 EXT/Session HTTP Response Header Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24268/info PHP is prone to an HTTP-response-header-injection vulnerability because it fails to sanitize user-supplied input. An attacker can exploit this issue to inject additional cookie attributes into session cookies...

PHP 5.2.4及之前版本存在多个漏洞

PHP是一款流行的网络编程语言。 PHP存在多个安全问题，远程攻击者可以利用漏洞进行缓冲区溢出，拒绝服务，和安全绕过攻击。 -dl处理文件名存在问题，可导致跨站脚本攻击。 -dl处理MAXPATHLEN参数大小存在问题，可导致拒绝服务攻击。 -tmlentities/htmlspecialchars处理部分多字节序列存在问题。 -fnmatch, setlocale和glob函数的glibc实现存在缓冲区溢出。 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 12.0 Slackware Linux 11.0...

PHP 5.2.3 - EXTSession HTTP Response Header Injection

PHP 5.2.3 - EXTSession HTTP Response Header Injection source: https://www.securityfocus.com/bid/24268/info PHP is prone to an HTTP-response-header-injection vulnerability because it fails to sanitize user-supplied input. An attacker can exploit this issue to inject additional cookie attributes in...

PHP 5.2.3 - EXT/Session HTTP Response Header Injection

source: https://www.securityfocus.com/bid/24268/info PHP is prone to an HTTP-response-header-injection vulnerability because it fails to sanitize user-supplied input. An attacker can exploit this issue to inject additional cookie attributes into session cookies. This may lead to other attacks. Th...