rubygem-loofah: XSS vulnerability due to unescaped comments within attributes by libxml2

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment...

CVE-2018-1296

CVE-2018-1296 : In Hadoop, HDFS exposes extended attribute key/value pairs during listXAttrs, due to verifying only path-level search access rather than path-level read permission to the referent. This can allow access to encryption secrets and other sensitive attributes. Affected: Apache Hadoop ...

The vulnerability of the fly-admin-gmc component, a graphical tool for administering domains and clients in the ALD fly-admin-ald-server operating system of Astra Linux, allows a perpetrator to cause service interruptions.

The vulnerability of the fly-admin-gmc graphical tool for administering domains and clients in the Astra Linux operating system relates to the improper assignment of token attributes during user creation in ALD. Exploiting this vulnerability allows an attacker to block new users from accessing th...

The vulnerability of the Vim text editor on the Astra Linux operating system allows a hacker to circumvent the restrictions imposed by the given security policy.

The vulnerability of the Vim text editor in the Astra Linux operating system is related to the improper saving of security attributes when files are modified. Exploiting this vulnerability allows an attacker to circumvent the security restrictions imposed by the specified security policy...

Medium: curl

Issue Overview: setfilemetadata in xattr.c in GNU Wget stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the URL by reading this...

Unbreakable Enterprise kernel security update

4.1.12-124.25.1 - x86/bugs: Fix the AMD SSBD usage of the SPECCTRL MSR Tom Lendacky Orabug: 28870524 CVE-2018-3639 - x86/bugs: Add AMD's SPECCTRL MSR usage Konrad Rzeszutek Wilk Orabug: 28870524 CVE-2018-3639 - x86/cpufeatures: rename X86FEATUREAMDSSBD to X86FEATURELSCFGSSBD Mihai Carabas Orabug:...

CVE-2018-3956

An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF document can trigger an out-of-bounds read, which can disclose sensitive memory content and aid in exploitation when...

CVE-2018-3956

CVE-2018-3956 is an out-of-bounds read/write vulnerability in Foxit Software’s PDF Reader/PhantomPDF related to handling of XFA element attributes. Affected products include Foxit Reader and Foxit PhantomPDF prior to version 9.4, with a specific reference to Foxit PDF Reader 9.1.0.5096. The vulne...

PT-2019-10730 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit Software's PDF Reader version 9.1.0.5096 Description: The issue is related to the handling of certain XFA element attributes, which can lead to an out-of-bounds read when a specially crafted PDF document is opened. This can result in th...

kernel: Heap-based buffer overflow in fs/ext4/xattr.c:ext4_xattr_set_entry() with crafted ext4 image

The Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4xattrsetentry function. An attacker could exploit this by operating on a mounted crafted ext4 image...

Information Disclosure

openstack-keystone is vulnerable to information disclosure. An authorization bypass on the listing projects via an authenticated GET /v3/OS-FEDERATION/projects request allows authenticated users to discover projects they have no authority to access, disclosing the project and attributes informati...

CVE-2019-5892

bgpd in FRRouting FRR aka Free Range Routing 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 not affecting Cumulus Linux or VyOS, when ENABLEBGPVNC is used for Virtual Network Control, allows remote attackers to cause a denial of service peering session flap via...

MGASA-2019-0015 Updated wget packages fix security vulnerability

Since version 1.19 Wget stores the URL and in certain cases the 'Referer' URL within extended attributes xattrs of the file system - by default. This includes username + password and other credentials or private data if those have been used within the URLs. Anyone with read access to those files...

Updated wget packages fix security vulnerability

Since version 1.19 Wget stores the URL and in certain cases the 'Referer' URL within extended attributes xattrs of the file system - by default. This includes username + password and other credentials or private data if those have been used within the URLs. Anyone with read access to those files...

Fedora 28 : elfutils (2018-cb25ae4b94)

Add support for ELF version, gnu property and gnu attrbutes notes. Fix eu-strip/eu-unstrip section group handling. Fixes CVE-2018-18310, CVE-2018-18520 and CVE-2018-18521. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Sanitize Input Validation Vulnerability

Sanitize Ruby is a whitelist-based HTML and CSS cleanup program. The program removes non-standard HTML and CSS from strings, etc. An input validation vulnerability exists in Sanitize Ruby version 4.6.0 and earlier. A remote attacker can exploit this vulnerability by applying unwhitelisted...

The vulnerability of the Postgresql database management system in the Astra Linux operating system allows a perpetrator to gain access to confidential data and cause service interruptions.

The vulnerability of the Postgresql database management system in the Astra Linux operating system is related to an error in the interaction with LDAP via parsec calls when retrieving user security attributes. Exploiting this vulnerability allows a malicious actor to gain access to information...

CVE-2018-20483

setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the URL by reading this attribut...

DEBIAN-CVE-2018-20483

setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the URL by reading this attribut...

CVE-2018-20483

setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the URL by reading this attribut...