8351 matches found
[SECURITY] [DLA 2004-1] 389-ds-base security update
Package : 389-ds-base Version : 1.3.3.5-4+deb8u7 CVE ID : CVE-2019-14824 Debian Bug : 944150 A flaw was found in the deref plugin of 389-ds-base where it could use the search permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private...
openSUSE Security Update : java-11-openjdk (openSUSE-2019-2565)
This update for java-11-openjdk to version jdk-11.0.5-10 fixes the following issues : Security issues fixed October 2019 CPU bsc1154212: - CVE-2019-2933: Windows file handling redux - CVE-2019-2945: Better socket support - CVE-2019-2949: Better Kerberos ccache handling - CVE-2019-2958: Build Bett...
openSUSE Security Update : java-11-openjdk (openSUSE-2019-2557)
This update for java-11-openjdk to version jdk-11.0.5-10 fixes the following issues : Security issues fixed October 2019 CPU bsc1154212: - CVE-2019-2933: Windows file handling redux - CVE-2019-2945: Better socket support - CVE-2019-2949: Better Kerberos ccache handling - CVE-2019-2958: Build Bett...
Duplicate Advisory: Possible remote code execution via a remote procedure call
Withdrawn: duplicate of GHSA-pj4g-4488-wmxm Original Description In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings...
GHSA-9GGP-4JPR-7PPJ Duplicate Advisory: Possible remote code execution via a remote procedure call
Withdrawn: duplicate of GHSA-pj4g-4488-wmxm Original Description In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings...
PT-2019-4525 · Illumos +1 · Illumos +1
Name of the Vulnerable Software and Affected Versions: Nexenta NexentaStor versions 4.0.5 through 5.1.2 Illumos affected versions not specified Description: The issue allows an attacker to have unintended access, for example, an attacker with WRITE XATTR can change permissions. This occurs due to...
Debian DLA-1995-1 : angular.js security update
Earlier versions of this package package were vulnerable to Cross-site Scripting XSS due to no proper sanitization of xlink:href attributes. For Debian 8 'Jessie', this problem has been fixed in version 1.2.26-1+deb8u1. We recommend that you upgrade your angular.js packages. NOTE: Tenable Network...
CVE-2019-18954
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious...
CVE-2019-18954
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious...
Xxe
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious...
Servicing stack update for Windows 10, version 1607: November 12, 2019
None None...
Servicing stack update for Windows 8.1, RT 8.1, and Server 2012 R2: October 8, 2019
Servicing stack update for Windows 8.1, RT 8.1, and Server 2012 R2: October 8, 2019 Summary This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Key changes include the following: Improves the Secure Boot revocation list DBX update...
Servicing stack update for Windows 10, version 1709: November 12, 2019
None None...
Servicing stack update for Windows 10, version 1809: November 12, 2019
None None...
Servicing stack update for Windows 10, version 1803: November 12, 2019
None None...
CVE-2019-18855
A Denial Of Service vulnerability exists in the safe-svg aka Safe SVG plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes...
CVE-2019-18857
darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript:alert substring...
Denial of service
A Denial Of Service vulnerability exists in the safe-svg aka Safe SVG plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes...
