Debian: Security Advisory (DLA-2178-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2178-1] awl security update

Package : awl Version : 0.55-1+deb8u1 CVE ID : CVE-2020-11728 CVE-2020-11729 Debian Bug : 956650 Following CVEs were reported against the awl source package: CVE-2020-11728 An issue was discovered in DAViCal Andrews Web Libraries AWL through 0.60. Session management does not use a sufficiently...

CVE-2020-11729

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful...

CVE-2020-11729

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful...

DEBIAN-CVE-2020-11729

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful...

UBUNTU-CVE-2020-11729

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful...

Design/Logic Flaw

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful...

CVE-2020-11729

An issue was discovered in DAViCal Andrew's Web Libraries AWL through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful...

CVE-2020-11729

CVE-2020-11729 affects DAViCal Andrew's Web Libraries (AWL) up to version 0.60. Long-term session cookies are not generated securely, enabling a brute-force-style session hijack. Debian/DLA-2178-1 fixes these issues by updating awl to 0.60-1+deb10u1 (and earlier 0.57-1+deb9u1). If deploying AWL, ...

XSS Vulnerability in Construction System of Guangzhou Sanjin Network Technology Co.

Guangzhou Sanjin Network Technology Co., Ltd. is a one-stop provider of Internet application services, providing e-commerce solutions for Chinese enterprises. XSS vulnerability exists in the construction system of Guangzhou Sanjin Network Technology Co. Attackers can utilize the vulnerability to...

Vesta Control Panel 0.9.8-26 - Authenticated Remote Code Execution Exploit

This Metasploit module exploits an authenticated command injection vulnerability in the v-list-user-backups bash script file in Vesta Control Panel to gain remote code execution as the root user. This module requires Metasploit: https://metasploit.com/download Current source:...

XSS Vulnerability in UQCMS Cloud Business-B2B2C System

UQCMS Cloud Business-B2B2C System Multi-merchant e-commerce system is a B2B2C e-commerce software. UQCMS Cloud Merchant-B2B2C System suffers from an XSS vulnerability that can be exploited by attackers to obtain administrator cookie information...

XSS Vulnerability in OurPHP Orad website builder system

OurPHP Aopia website building system is a enterprise + e-commerce marketing website building system. There is an XSS vulnerability in the OurPHP website builder system, which can be exploited by attackers to obtain administrator cookie information...

Overlay Malware Exploits Chrome Browser, Targets Banks and Heads to Spain

Researchers are warning of a remote overlay malware attack that leverages a fake Chrome browser plugin to target the accounts of banking customers in Spain. Grandoreiro is a type of remote overlay banking trojan, designed to help attackers overtake devices and display a full-screen overlay image...

Information Disclosure

httpd is vulnerable to information disclosure. The vulnerability exists as the httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this fla...

Same-Origin Policy Bypass

thunderbird/firefox is vulnerable to Same-Origin Policy bypass. It was found that Thunderbird could treat two separate cookies for web content as interchangeable if both were for the same domain name but one of those domain names had a trailing "." character. This violates the same-origin policy...

Information Disclosure

squirrelmail is vulnerable to information disclosure. It was discovered that SquirrelMail allowed cookies over insecure connections ie did not restrict cookies to HTTPS connections. An attacker who controlled the communication channel between a user and the SquirrelMail server, or who was able to...

Information Disclosure

JRE proxy implementation is vulnerable to information disclosure. Two flaws were found in the JRE proxy implementation. An untrusted applet or application could use these flaws to discover the usernames of users running applets and applications, or obtain web browser cookies and use them for...

Privilege Escalation

JRE proxy implementation is vulnerable to privilege escalation. Two flaws were found in the JRE proxy implementation. An untrusted applet or application could use these flaws to discover the usernames of users running applets and applications, or obtain web browser cookies and use them for sessio...

Information Disclosure

firefox is vulnerable to information disclosure. A flaw was found in the way Firefox treated HTTPOnly cookies. An attacker able to execute arbitrary JavaScript on a target site using HTTPOnly cookies may be able to use this flaw to steal the cookie...