PT-2019-11808 · Jenkins · Jenkins Git Changelog Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Git Changelog Plugin versions 2.17 and earlier Description: The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master or controller. Specifically, MediaWiki and Jira passwords...

CVE-2019-10414: Insufficiently Protected Credentials

Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

SUSE-SU-2019:14179-1 Security update for libxml2

This update for libxml2 doesn't fix any additional security issues, but correct its rpm changelog to reflect all CVEs that have been fixed over the past...

PT-2019-20191

Name of the Vulnerable Software and Affected Versions libxml2 affected versions not specified Description The issue concerns an update for libxml2 that corrects its rpm changelog to reflect all security issues that have been fixed in the past. There is no information about the estimated number of...

UPDATE: MITRE CALDERA 2.3.0

PenTestIT RSS Feed A month ago, MITRE Caldera 2.2.0 was released and a couple of days back now MITRE CALDERA 2.3.0 was released as well. If you remember, I wrote briefly about this automated adversary emulation system in my post titled – List of Adversary Emulation Tools. A lot of changes have be...

webmin -- unauthenticated remote code execution

Joe Cooper reports: I've rolled out Webmin version 1.930 and Usermin version 1.780 for all repositories. This release includes several security fixes, including one potentially serious one caused by malicious code inserted into Webmin and Usermin at some point on our build infrastructure. We're...

CVE-2019-18955

The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019...

CentOS Control Web Panel 0.9.8.836 - Privilege Escalation Vulnerability

Exploit for linux platform in category web applications //====================================================================\ || || || CWP Control Web Panel 0.9.8.836 - 0.9.8.839 || || Root Privilege Escalation || || || \====================================================================//...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (SACK Panic) (SACK Slowness)

Based on the RPM metadata this appears to be a security kernel. The RPM changelog shows fixes related to Security Fixes : - An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment SACK segments. While processing SACK segments, t...

JShielder v2.4 - Hardening Script For Linux Servers/ Secure LAMP-LEMP Deployer/ CIS Benchmark G

JSHielder is an Open Source Bash Script developed to help SysAdmin and developers secure there Linux Servers in which they will be deploying any web application or services. This tool automates the process of installing all the necessary packages to host a web application and Hardening a Linux...

Whonix v15 - Anonymous Operating System

Whonix is an operating system focused on anonymity, privacy and security. It’s based on the Tor anonymity network, Debian GNU/Linux and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user’s real IP. Whonix consists of two parts: One...

XXE Vulnerability

This is: - a bugfix - a new feature - X security Checklist: - X Changes are covered by unit tests - X Code style is respected - X Commit message explains why the change is made see https://github.com/erlang/otp/wiki/Writing-good-commit-messages - X CHANGELOG.md contains a short summary of the...

Lynis 2.7.5 - Security Auditing Tool for Unix/Linux Systems

We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...

Security update for ansible (moderate)

openSUSE Security Update: Security update for ansible Announcement ID: openSUSE-SU-2019:1635-1 Rating: moderate References: 1109957 1112959 1118896 1126503 Cross-References: CVE-2018-16837 CVE-2018-16859 CVE-2018-16876 CVE-2019-3828 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.1 openSUS...

Wampserver 3.1.8 Cross Site Request Forgery

Affected product: WampServer 3.1.4-3.1.8 Offiical description: "WampServer is a Windows web development environment. It allows you to create web applications with Apache2, PHP and a MySQL database. Alongside, PhpMyAdmin allows you to manage easily your databases." Official website:...

GLSA-201811-06 : libde265: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201811-06 libde265: Multiple vulnerabilities Multiple vulnerabilities have been discovered in libde265. Please review libde265 changelog referenced below for details. Impact : A remote attacker could entice a user to open a...

openSUSE Security Update : bitcoin (openSUSE-2019-731)

This update for bitcoin to version 0.16.3 fixes the following issues : - CVE-2018-17144: Prevent remote denial of service application crash exploitable by miners via duplicate input bsc1108992. For additional changes please check the changelog. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

openSUSE Security Update : haproxy (openSUSE-2019-824)

This update for haproxy to version 1.8.14 fixes the following issues : These security issues were fixed : - CVE-2018-14645: A flaw was discovered in the HPACK decoder what caused an out-of-bounds read in hpackvalididx that resulted in a remote crash and denial of service bsc1108683 -...

AcyMailing 5.10.6 Various

AcyMailing 5.10.6 Various new version number 5.10.7 UpdateNotice URL https://www.acyba.com/support/change-log.html Changelog Url https://www.acyba.com/support/change-log.html...

OPENSUSE-SU-2019:0329-1 Security update for obs-service-tar_scm

This update for obs-service-tarscm fixes the following issues: Security vulnerabilities addressed: - CVE-2018-12473: Fixed a path traversal issue, which allowed users to access files outside of the repository using relative paths bsc1105361 - CVE-2018-12474: Fixed an issue whereby crafted service...