Symfony 4.4.x < 4.4.4, 5.0.x < 5.0.4 Information Disclosure Vulnerability

Symfony is prone to an information disclosure vulnerability. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Softwa...

PT-2020-18365 · Symfony · Symfony Security Http

Name of the Vulnerable Software and Affected Versions: symfony/security-http versions 4.4.0 through 4.4.6 symfony/security-http versions 5.0.0 through 5.0.6 Description: The issue arises when a Firewall checks access control rules using the unanimous strategy. In affected versions, the Firewall...

CVE-2020-5275: All "access_control" rules are required when a firewall uses the unanimous strategy

Affected versions Symfony 4.4.0 to 4.4.6 and 5.0.0 to 5.0.6 versions of the Symfony ErrorHandler component are affected by this security issue. The issue has been fixed in Symfony 4.4.7 and 5.0.7. Description On Symfony before 4.4.0, when a Firewall checks an access control rule using the unanimo...

Arbitrary Code Execution

Overview node-rules is a light weight forward chaining Rule Engine, written in JavaScript. Affected versions of this package are vulnerable to Arbitrary Code Execution. The injection point is located in line 152,153. The argument rules of function fromJSON can be controlled by users without any...

CVE-2007-6758

Server-side request forgery SSRF vulnerability in feed-proxy.php in extjs 5.0.0...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in feed-proxy.php in extjs 5.0.0...

CVE-2007-6758

Server-side request forgery SSRF vulnerability in feed-proxy.php in extjs 5.0.0...

CVE-2007-6758

Server-side request forgery SSRF vulnerability in feed-proxy.php in extjs 5.0.0...

CVE-2007-6758

CVE-2007-6758 describes a Server-Side Request Forgery (SSRF) in feed-proxy.php of ExtJS 5.0.0. Affected component/file: feed-proxy.php; root cause not detailed in available documents beyond SSRF. Impact semantics: CVSS v2 base score 5.0 (MEDIUM) and CVSS v3.1 base score 7.5 (HIGH) with Network ac...

PYSEC-2020-94

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

CVE-2019-18625

An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST...

CVE-2019-18792

An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet containing the data will be ignored by...

Design/Logic Flaw

An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet containing the data will be ignored by...

PT-2020-6918 · Suricata · Suricata

Name of the Vulnerable Software and Affected Versions: Suricata version 5.0.0 Description: A problem was discovered in Suricata where it is possible to bypass or evade any TCP-based signature by faking a closed TCP session using a malicious server. After the TCP SYN packet, it is possible to inje...

Apache Solr Code Injection Vulnerability

Apache Solr is the United States Apache Apache Software Foundation of a Lucene a full-text search engine based on the search server . The product supports level search , vertical search , highlighting search results and so on. A code injection vulnerability exists in Apache Solr versions 5.0.0...

CVE-2019-19927

In the Linux kernel 5.0.0-rc7 as distributed in ubuntu/linux.git on kernel.ubuntu.com, mounting a crafted f2fs filesystem image and performing some operations can lead to slab-out-of-bounds read access in ttmputpages in drivers/gpu/drm/ttm/ttmpagealloc.c. This is related to the vmwgfx or ttm modu...

Linux kernel CVE-2019-19927 Denial of Service Vulnerability

Description Linux kernel is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service conditions. Linux kernel 5.0.0-rc7 is vulnerable; other versions may also be affected. Technologies Affected Linux kernel 5.0.0-rc7 Recommendations Permit local...

PT-2019-5683 · Apache +1 · Apache Solr +1

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 5.0.0 through 8.3.1 Description: The issue is related to insufficient input validation in the VelocityResponseWriter component of Apache Solr, allowing for remote code execution. A Velocity template can be provided throug...

CVE-2019-6031

Cross-site scripting vulnerability in KINZA for Windows version 5.9.2 and earlier and for Mac version 5.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via RSS reader...

CVE-2019-19151

On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell tmsh privileges are able access object...