245 matches found
CVE-2019-10048
The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input in the plugin's configuration options, allowing arbitrary shell commands to be entered that result in command execution on the underlying...
SUSE-SU-2019:1033-1 Security update for ImageMagick
This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel bsc1130330. - CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage bsc1131317. - CVE-2019-7175: Fixed multiple memory leaks in...
Critical WordPress Plugin Flaw Allows Complete Website Takeover
A critical vulnerability in popular WordPress plugin Simple Social Buttons enables non-admin users to modify WordPress installation options – and ultimately take over websites. Simple Social Buttons enables users to add social-media sharing buttons to various locations of their websites. The plug...
Flexible and Powerful Reverse Proxy: Modlishka
Modlishka is a flexible and powerful reverse proxy, that will take your phishing campaigns to the next level. It was realeased with an aim to: help penetration testers to carry out an effective phishing campaign and reinforce the fact that serious threat can arise from phishing. show current 2FA...
USN-3825-2: mod_perl vulnerability
USN-3825-1 fixed a vulnerability in modperl. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Jan Ingvoldstad discovered that modperl incorrectly handled configuration options to disable being used by unprivileged users, contrary to the documentation....
USN-3825-1 libapache2-mod-perl2 vulnerability
Jan Ingvoldstad discovered that modperl incorrectly handled configuration options to disable being used by unprivileged users, contrary to the documentation. A local attacker could possibly use this issue to execute arbitrary Perl code...
Subdomain Discovery Tool: SubFinder
SubFinder is a subdomain discovery tool that uses various techniques to discover massive amounts of subdomains for any target. It has been aimed as a successor to the sublist3r project . SubFinder uses Passive Sources, Search Engines, Pastebins, Internet Archives, etc to find subdomains and then ...
Open Web Analytics < 1.5.7 PHP Object Injection Vulnerability
Open Web Analytics is prone to a PHP object injection vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Design/Logic Flaw
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of...
CVE-2017-12636
CouchDB administrative users can configure the database server via HTTPS. Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitra...
samba: Some code path don't enforce smb signing, when they should
It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text...
samba: Some code path don't enforce smb signing, when they should
It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text...
samba: Some code path don't enforce smb signing, when they should
It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text...
Design/Logic Flaw
Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account and similarly can have nagios.cfg owned by a non-root account, which allows local users to gain privileges by leveraging access to this non-ro...
SUSE SLES11 Security Update : sblim-sfcb (SUSE-SU-2017:1008-1)
This update for sblim-sfcb fixes the following issues: Feature enhancements : - A separate sblim-sfcb-openssl1 package was added to the SECURITY Module. fate322032/bsc1012814 This package can be installed additionally, and the SysV Init script will pick the openssl1 variant on the next start,...
SUSE-SU-2017:1008-1 Security update for sblim-sfcb
This update for sblim-sfcb fixes the following issues: Feature enhancements: - A seperate sblim-sfcb-openssl1 package was added to the SECURITY Module. fate322032/bsc1012814 This package can be installed additionaly, and the SysV Init script will pick the openssl1 variant on the next start,...
SUSE-SU-2017:0855-1 Security update for nodejs4
This update for nodejs4 fixes the following issues: - New upstream LTS release 4.7.3 The embedded openssl sources were updated to 1.0.2k CVE-2017-3731, CVE-2017-3732, CVE-2016-7055, bsc1022085, bsc1022086, bsc1009528 - No changes in LTS version 4.7.2 - New upstream LTS release 4.7.1 build: shared...
Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p10 Multiple Vulnerabilities
The version of the remote NTP server is 4.x prior to 4.2.8p10. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists in the receive function within file ntpd/ntpproto.c due to the expected origin timestamp being cleared when a packet with a zero...
[SECURITY] [DSA 3747-1] exim4 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3747-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 25, 2016 https://www.debian.org/security/faq -...