rsyslog security, bug fix, and enhancement update

8.1911.0-3 RHEL 8.2.0 ERRATUM - added patch reverting rejecting expired certs by default resolves: rhbz1782353 - added patch silencing false errors on config.enabled statement resolves: rhbz1659383 8.1911.0-2 RHEL 8.2.0 ERRATUM - cleaned old patches, fixed patch names resolves: rhbz1740683...

CVE-2020-5328

Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur...

CVE-2020-5328

Dell EMC Isilon OneFS before version 8.2.0 contains an unauthorized access vulnerability due to insufficient authorization checks when SyncIQ is licensed; encrypted syncs are not marked as required, potentially allowing loss of cluster control. The issue affects the Isilon OneFS platform (SyncIQ-...

Denial Of Service (DoS)

numpy is vulnerable to denial of service DoS. Saving large arrays as csv causes a segmentation fault when it is executing with GCC 8.2.0 on python 3.6.7. Note that an attacker could potentially obtain arbitrary code execution from the resulting segmentation fault...

Cross site request forgery (csrf)

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debuggi...

SugarCRM Web Logic Hooks Module Path Traversal

-------------------------------------------------------------- SugarCRM Web Logic Hooks module Path Traversal Vulnerability -------------------------------------------------------------- - Software Link: http://www.sugarcrm.com - Affected Versions: All versions prior to 7.9.5.0, 8.0.2, and 8.2.0....

Security Bulletin: Multiple Vulnerabilities found in products bundled with IBM Security Access Manager for Enterprise Single-Sign On

Summary IBM WebSphere Application Server is shipped as a component of IBM Security Access Manager for Enterprise Single-Sign On. Information about Security vulnerabilities affecting IBM WebSphere Application Server have been published in security bulletins. Vulnerability Details Consult the...

CVE-2018-1999017

Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...

CVE-2018-1999017

Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery SSRF vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradePath$url that can result in an authenticated admin users requesting arbitrary URL's, pivoting requests through the server. This attack appear...

Cross site scripting

Pydio version 8.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating...

CVE-2018-1999016

Pydio version 8.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating...

CVE-2018-1999016

Pydio version 8.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating...

CVE-2018-13790

A Server Side Request Forgery SSRF vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page...

Security Bulletin: GNU C library (glibc) vulnerability is fixed in IBM Security Access Manager for Enterprise Single Sign-On Virtual Appliance (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM Security Access Manager for Enterprise Single Sign-On Virtual Appliance ISAM ESSO VA Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION: glibc is vulnerable to a heap-based buffer overflow, caused by...

CrushFTP HTTP Injection Vulnerability

CrushFTP is a cross-platform Java FTP server from the U.S. CrushFTP company . A security vulnerability exists in CrushFTP versions prior to 7.8.0 and 8.x versions prior to 8.2.0. No detailed vulnerability details are provided at this time...

CVE-2017-14035

CrushFTP 8.x before 8.2.0 has a serialization vulnerability...

CVE-2017-14036

CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS...

CVE-2017-14038

CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability...

CVE-2017-14036

CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS...

Sendio Local File Inclusion Vulnerability

Sendio is affected by a Local File Inclusion vulnerability that allows an unauthenticated, remote attacker to read potentially sensitive system files via a specially crafted URL. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...