patch: do_ed_script in pch.c does not block strings beginning with a ! character

A flaw was found in GNU patch through version 2.7.6. Strings beginning with a exclamation mark are not blocked by default. When ed receives an exclamation mark-prefixed command line argument, the argument is executed as a shell command. The highest threat from this vulnerability is to data...

The vulnerability of the implementation of the simple network management protocol SNMP in the Cisco NX-OS operating system’s ACL function allows a attacker to influence the integrity of the protected information.

The vulnerability of the implementation of the simple network management protocol SNMP in the Cisco NX-OS operating system stems from incorrect checking of the name of the ACL with a maximum length. Exploiting this vulnerability allows an attacker, operating remotely, to compromise the integrity ...

The vulnerability of the HTTP traffic filtering component of Cisco Firepower Threat Defense’s micro-programming-based network interface controllers, as well as Cisco FirePOWER Services Software for ASA and Cisco Firepower Management Center’s network management software, allows attackers to influence the integrity of protected information.

The vulnerability of the HTTP traffic filtering component in Cisco Firepower Threat Defense, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center software is caused by errors in HTTP request processing. Exploiting this vulnerability allows a malicious actor to influenc...

PT-2021-4514 · FFmpeg +5 · Ffmpeg +5

Name of the Vulnerable Software and Affected Versions: Ffmpeg affected versions not specified Description: The issue is related to a heap-based Buffer Overflow vulnerability in the gaussian blur component of the Ffmpeg library. This vulnerability can be exploited by a remote attacker to gain acce...

PT-2019-5207 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.3 Description: The issue is related to the incorrect handling of media during upload in the WordPress content management system, specifically affecting the wp ajax upload attachment function. This can allow a...

PT-2019-5218 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a stored XSS attack that allows an attacker to inject JavaScript into STYLE elements. This can potentially impact the integrity of the data. The exploitation of this issue...

PT-2019-5220 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a stored XSS cross-site scripting vulnerability via the Customizer. This vulnerability can be exploited by a remote attacker to impact data integrity. Recommendations: For...

PT-2019-5208 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.3 Description: The issue is related to an error in handling stored comments, allowing for XSS attacks. This could potentially enable a remote attacker to impact data integrity. Recommendations: For WordPress...

PT-2019-5212 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.3 Description: The issue is related to incorrect URL sanitization in the wp kses bad protocol once function, which can lead to cross-site scripting XSS attacks. This could allow a remote attacker to compromise...

PT-2019-5213 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.3 Description: The issue is related to an error in the content management system of WordPress, allowing for a Cross-Site Scripting XSS attack when authorized users view post previews. This could enable a remote...

The vulnerability of the OpenSSL library, related to errors in the certificate validation process, allows attackers to compromise the integrity of data.

The vulnerability of the OpenSSL library is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

Limesurvey XML Injection Vulnerability

limesurvey is an open source online questionnaire program with many functions such as questionnaire design, modification, release, recovery and statistics. An XML injection vulnerability exists in Limesurvey versions prior to 3.17.14. A remote attacker can exploit this vulnerability to import a...

PT-2019-6144 · Unknown +9 · Squashfs-Tools +9

Name of the Vulnerable Software and Affected Versions: Squashfs-Tools version 4.5 Description: The issue is related to the squashfs opendir function in the unsquash-2.c component of Squashfs-Tools, which incorrectly handles symbolic links before accessing a file. This allows a remote attacker to...

CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

Design/Logic Flaw

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

Implementing EQR — Creating a Solution for Real-Time Processing of Disparate Big Data Sources

Building an Event Query Router for Big Data Translation and Processing In a previous post, we discussed the data engineering challenge of scaling security. Analyzing the volume and variety of data required by a cybersecurity application isn’t an easy process, so we are always looking for innovati...

kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction

A flaw was found in the KDE Frameworks KConfig prior to version 5.61.0. Certain syntax commands were allowed in .desktop, .directory, and configuration files to allow flexible configurations with the desktop environment. An attacker could add malicious code to a file that a user would...

CVE-2019-5611

In FreeBSD 12.0-STABLE before r350828, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r350829, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, a missing check in the function to arrange data in a chain of mbufs could cause data returned not to be contiguou...