3000 matches found
CVE-2020-1930
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration .cf files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same...
Cross site scripting
Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations...
CVE-2020-2106: Improper Neutralization of Input During Web Page Generation
Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations...
Huawei EulerOS: Security Advisory for firewalld (EulerOS-SA-2019-2377)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2018-16272
The wpasupplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2...
CVE-2018-16267
The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Such actions include the triggering system poweroff menu, and prompting a popup with arbitrary strings. This affects Tizen before...
CVE-2018-16267
The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Such actions include the triggering system poweroff menu, and prompting a popup with arbitrary strings. This affects Tizen before...
CVE-2018-1002200
A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names. A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or...
USN-4235-2: nginx vulnerability
USN-4235-1 fixed a vulnerability in nginx. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly handled certain errorpage configurations. A remote attacker could possibly use this...
CVE-2020-1608 Junos OS: MX Series: In BBE configurations, receipt of a specific MPLS or IPv6 packet causes a Denial of Service
Receipt of a specific MPLS or IPv6 packet on the core facing interface of an MX Series device configured for Broadband Edge BBE service may trigger a kernel crash vmcore, causing the device to reboot. The issue is specific to the processing of packets destined to BBE clients connected to MX Serie...
Xen Denial of Service Vulnerability (XSA-301)
According to its self-reported version number, the Xen Hypervisor installed on the remote host is affected by a denial of service vulnerability due to improper validation of input data. An authenticated, remote attack can exploit this, via a specially crafted hypercall followed by an access to an...
USN-4235-1: nginx vulnerability
Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly handled certain errorpage configurations. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks and access resources contrary to expectations...
CVE-2019-20372
NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer...
CVE-2019-20372
NGINX (on Amazon Linux 2) is affected by CVE-2019-20372 when configured with certain error_page settings, enabling HTTP request smuggling. The Amazon Linux 2 ALAS advisory ALAS2NGINX1-2023-004 confirms vulnerable 1.17.x/older configurations and provides patched packages: nginx 1.18.0 and related ...
F5 Networks BIG-IP : TMM vulnerability (K06747393)
Under certain conditions, when using custom TCP congestion control settings in a TCP profile, TMM stops processingtraffic when processed by an iRule. CVE-2019-6677 Impact The Traffic Management Microkernel TMM may generate a core file and restart, causing a traffic disruption or failover event.Th...
VulnCheck KEV: CVE-2019-11043
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution...
Authorization Bypass
drupal/drupal is vulnerable to authorization bypass. Lack of restriction to media items in the Media Library allows an attacker to bypass authorization in specific configurations of Drupal...
RancherOS < 1.4.0 Information Disclosure
The remote host is running a version of RancherOS prior to 1.4.0, hence is exposted to a side-channel vulnerabilities: - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a...
DRUPAL-CORE-2019-011
The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations...
Security Bulletin: IBM 10x vulnerability in IBM Control Center could allow a remote attacker to obtain sensitive information (CVE-2016-0341)
Summary IBM 10x vulnerability in IBM Control Center could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2016-0341 DESCRIPTION: IBM 10x could allow a malicious user to obtain highly sensitive information due to missing configurations of HTTPS. CVSS Base...