tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

PHP Server Monitor 3.3.1 - Cross-Site Request Forgery

PHP Server Monitor 3.3.1 - Cross-Site Request Forgery Exploit Title: PHP Server Monitor 3.3.1 - Cross-Site Request Forgery Exploit Author: Javier Olmedo Website: https://www.sidertia.com Date: 2018-11-28 Google Dork: N/A Vendor: https://www.phpservermonitor.org/ Software Link:...

PHP Server Monitor 3.3.1 - Cross-Site Request Forgery

Exploit Title: PHP Server Monitor 3.3.1 - Cross-Site Request Forgery Exploit Author: Javier Olmedo Website: https://www.sidertia.com Date: 2018-11-28 Google Dork: N/A Vendor: https://www.phpservermonitor.org/ Software Link: https://github.com/phpservermon/phpservermon/releases/tag/v3.3.1 Affected...

DEBIAN-CVE-2018-12120

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate...

UBUNTU-CVE-2018-12120

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate...

[SECURITY] Fedora 28 Update: git-2.17.2-2.fc28

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The git rpm installs common set of tools which are usually using with small amount of dependencies. To install all git packages,...

kernel: Use-after-free in the vmacache_flush_all function resulting in a possible privilege escalation

A security flaw was discovered in the Linux kernel. The vmacacheflushall function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free and possibly gain privileges via certain thread creation, map, unmap, invalidation, and dereference operations...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc1) +22 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.0.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.5.0.rc2), org.eclipse.jetty.aggregate:jetty-all-server (7.5.0.rc2) +43 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.5.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version 7.5.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.5.0.rc2 - org.eclipse.jetty.aggregate:jetty-all-server...

com.hazelcast:hazelcast-jetty7-sessionmanager (>=1.0, <=1.0.2), org.akhikhl.gretty:gretty-runner-jetty7 (>=1.1.9, <=2.0.0) +52 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.16.v20140903)

org.eclipse.jetty:jetty-server MAVEN version 7.6.16.v20140903 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.hazelcast:hazelcast-jetty7-sessionmanager =1.0, =1.1.9, =1.4.10, =1.4.14 -...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc0) +22 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.0.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.1.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.1.0.rc1) +33 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.1.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.1.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.cometd.java:cometd-java-examples (2.4.0.rc3), org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc5) +46 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-java-examples 2.4.0.rc3 - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc...

org.eclipse.jetty.aggregate:jetty-all (7.4.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.4.0.rc0) +40 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.4.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.4.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.4.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (8.1.0.rc2), org.eclipse.jetty.aggregate:jetty-all-server (8.1.0.rc2) +42 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (8.1.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version 8.1.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.0.rc2 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc6), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc6) +32 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.0.0.rc6)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc6 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc6 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.4.1.v20110513), org.eclipse.jetty.aggregate:jetty-all-server (7.4.1.v20110513) +56 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.4.1.v20110513)

org.eclipse.jetty:jetty-server MAVEN version 7.4.1.v20110513 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.4.1.v20110513 -...

org.eclipse.jetty.aggregate:jetty-all (7.6.20.v20160902), org.eclipse.jetty.aggregate:jetty-all-server (7.6.20.v20160902) +36 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.20.v20160902)

org.eclipse.jetty:jetty-server MAVEN version 7.6.20.v20160902 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.20.v20160902 -...

org.eclipse.jetty.aggregate:jetty-all (8.1.0.rc5), org.eclipse.jetty.aggregate:jetty-all-server (8.1.0.rc5) +43 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (8.1.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 8.1.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.0.rc5 - org.eclipse.jetty.aggregate:jetty-all-server...

GHSA-JHGP-HVJ6-X2P2 Stored Cross-Site Scripting in tianma-static

All versions of tianma-static are vulnerable to stored cross-site scripting XSS. The vulnerability is exploitable if a user can control the name of a file that is served by tianma-static Recommendation As no fix is available for this vulnerability at this time it is our recommendation to use...