UBUNTU-CVE-2019-19844

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address that is equal to an existing user's email address after case transformation of Unicode characters would allow an attacker to be sent a password reset token for the matched user...

Security Bulletin: A denial of service vulnerability has been identified with Case Client component shipped with IBM Business Automation Workflow and IBM Case Manager (CVE-2019-12402)

Summary Case Client component shipped with IBM Business Automation Workflow and IBM Case Manager is vulnerable to denial of service, caused by an error in the internal file name encoding algorithm with Apache Commons Compress. By persuading a victim to open specially crafted ZIP archive containin...

Announcing New Customer Support Portal and Unified Search

Qualys is rolling out new unified search and an improved online customer support experience, along with Support content integrated directly into Qualys Community. It's coming in January 2020. These new features are part of our efforts to enable customer success with an integrated community...

PT-2019-4872

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.11.27 Django versions 2.x prior to 2.2.9 Django versions 3.x prior to 3.0.1 Description The issue allows account takeover by sending a password reset token to an attacker for a matched user account. This occurs when ...

CVE-2019-4426

The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2019-4426

The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

Cross site scripting

The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2019-4426

CVE-2019-4426 is a cross-site scripting vulnerability in the Case Builder component of IBM Case Manager (versions 5.1.1–5.3) and IBM Business Automation Workflow (18.0.0.0–19.0.0.2). The root cause is inadequate sanitization of user input in the Web UI, allowing arbitrary JavaScript execution and...

CVE-2019-4426

The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

IBM Case Manager Cross-Site Scripting Vulnerability (CNVD-2019-45391)

IBM Case Manager is a solution for managing cases from IBM USA. The solution supports the combination of content, processes and people, and provides frameworks, relevance methods and integration tools to view a holistic view of cases. A cross-site scripting vulnerability exists in IBM Case Manage...

Ffuf - Fast Web Fuzzer Written In Go

A fast web fuzzer written in Go. Heavily inspired by the great projects gobuster and wfuzz. Features Fast! Allows fuzzing of HTTP header values, POST data, and different parts of URL, including GET parameter names and values Silent mode -s for clean output that's easy to use in pipes to other...

CVE-2012-1105

creationtimestamp| type| source ---|---|--- 2019-12-05 22:27:23+00:00| seen| https://t.me/cibsecurity/8531...

Design/Logic Flaw

verifycertificateidentity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to 1 multiple wildcards, 1 wildcards in IDNA names, 3 case...

CVE-2015-1855

verifycertificateidentity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to 1 multiple wildcards, 1 wildcards in IDNA names, 3 case...

CVE-2019-16767

The admin sys mode is now conditional and dedicated for the special case. By default, since [email protected] no instance container is launched with advanced capabilities not launched as root...

Code injection

SQLite 3.30.1 mishandles pExpr-y.pTab, as demonstrated by the TKCOLUMN case in sqlite3ExprCodeTarget in expr.c...

IBM Case Manager CVE-2019-4426 Cross Site Scripting Vulnerability

Description IBM Case Manager is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the...

CVE-2019-19242

CVE-2019-19242 affects SQLite 3.30.1, where mishandling of pExpr->y.pTab in sqlite3ExprCodeTarget (TK_COLUMN) causes a NULL pointer dereference in sqlite3ExprCodeTarget, potentially crashing the process. CVSSv3 base score 5.9 (MEDIUM). The Astra Linux bulletin confirms the SQLite 3.30.1 refere...

CVE-2019-19039

btrfsfreeextent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfsprintleaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as no...

PT-2019-4253 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.3.12 Description: The issue in the Linux kernel's btrfs free extent function allows local users to obtain potentially sensitive information about register values via the dmesg program in a certain ENOENT case...