72 matches found
SUSE SLES15: kernel-livepatch-5_3_18-150200_24_134-default / etc (SUSE-SU-2022:4038-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4038-1 advisory. This update for the Linux Kernel 5.3.18-15020024134 fixes several issues. The following security issues were fixed: - CVE-2021-39698: Fixed a...
CVE-2021-4038
creationtimestamp| type| source ---|---|--- 2021-12-09 18:23:52+00:00| seen| https://t.me/cibsecurity/33689...
CVE-2021-4038
Cross Site Scripting XSS vulnerability in McAfee Network Security Manager NSM prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in a...
CVE-2021-4038
CVE-2021-4038 affects McAfee Network Security Manager (NSM) prior to 10.1 Minor 7. The vulnerability arises from improper sanitization of custom rule content containing HTML, allowing a remote authenticated administrator to embed XSS in the NSM administrator interface. Impact is limited to XSS vi...
RHEL 7 : binutils (RHSA-2021:4038)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4038 advisory. The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar...
SUSE: Security Advisory (SUSE-SU-2014:0928-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-4038
GraphQL Playground graphql-playground-html NPM package before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Not...
CVE-2020-4038
The CVE-2020-4038 entry concerns GraphQL Playground (graphql-playground-html) with an XSS reflection vulnerability in versions before 1.6.22, triggered by unsanitized input rendered in renderPlaygroundPage(). A patch is available in graphql-playground-html v1.6.22, and related middleware packages...
CVE-2015-4039
Multiple cross-site scripting XSS vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified 1 profile fields or 2 new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmatio...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified 1 profile fields or 2 new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmatio...
CVE-2015-4039
The CVE-2015-4039 entry corresponds to the WordPress WP Membership plugin version 1.2.3, which contains stored XSS vulnerabilities. According to the sources, remote authenticated users can inject arbitrary script or HTML via (1) profile fields or (2) new post content. An additional note indicates...
Ubuntu 16.04 LTS / 18.04 LTS : bzip2 regression (USN-4038-3)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4038-3 advisory. USN-4038-1 fixed a vulnerability in bzip2. The update introduced a regression causing bzip2 to incorrect raises CRC errors for some files. We apologiz...
Ubuntu 16.04 LTS / 18.04 LTS : bzip2 vulnerabilities (USN-4038-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4038-1 advisory. Aladdin Mubaied discovered that bzip2 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of...
Privilege Escalation
The ppc64-diag packages provide diagnostic tools for Linux on the 64-bit PowerPC platforms. The platform diagnostics write events reported by the firmware to the service log, provide automated responses to urgent events, and notify system administrators or connected service frameworks about the...
CVE-2019-4038
CVE-2019-4038 affects IBM Security Identity Manager (ISIM). Affects ISIM 6.0.0–6.0.0.20 and 7.0.0–7.0.1.10. Root cause enables attacker to create unexpected control flow paths, potentially bypassing security checks and enabling a limited form of code injection. IBM provides fixes: 6.0.0-ISS-SIM-F...
Security Bulletin: IBM Security Identity Manager is affected by a limited code injection vulnerability (CVE-2019-4038)
Summary IBM Security Identity Manager ISIM has addressed the following vulnerability that can allow attackers to compromise user accounts via limited code injection. Vulnerability Details CVEID: CVE-2019-4038 DESCRIPTION: IBM Security Identity Manager could allow an attacker to create unexpected...
CVE-2018-4038
An exploitable arbitrary write vulnerability exists in the open document format parser of the Atlantis Word Processor, version 3.2.7.2, while trying to null-terminate a string. A specially crafted document can allow an attacker to pass an untrusted value as a length to a constructor. This...
CVE-2018-4038
CVE-2018-4038 is a memory-corruption, arbitrary-write vulnerability in the Atlantis Word Processor open document format parser. Cisco Talos details show the issue stems from an insecure length handling in the NewAnsiString path within the parser’s buffer/heap management (text processing via LStrS...
Security Bulletin: PowerKVM is affected by ppc64-diag and powerpc-utils vulnerabilities (Multiple CVEs)
Summary PowerKVM is affected by multiple vulnerabilities in ppc64-diag and powerpc-utils. Vulnerability Details CVEID: CVE-2014-4038 DESCRIPTION: ppc64-diag could allow a local attacker to launch a symlink attack. lpdelatest.sh creates temporary files insecurely. A local attacker could exploit th...