GHSA-F7QW-5PVG-MMWP Prototype Pollution in lutils-merge

All versions of lutils-merge are vulnerable to Prototype Pollution. The merge function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other...

Prototype Pollution in lutils-merge

All versions of lutils-merge are vulnerable to Prototype Pollution. The merge function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other...

GHSA-57CF-349J-352G Out-of-bounds Read in npmconf

Versions of npmconf before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x. Recommendation Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used...

Out-of-bounds Read in npmconf

Versions of npmconf before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x. Recommendation Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used...

Buffer overflow

In QEMU 3.1.0, loaddevicetree in devicetree.c calls the deprecated loadimage function, which has a buffer overflow risk...

DEBIAN-CVE-2018-20815

In QEMU 3.1.0, loaddevicetree in devicetree.c calls the deprecated loadimage function, which has a buffer overflow risk...

CVE-2018-20815

In QEMU 3.1.0, loaddevicetree in devicetree.c calls the deprecated loadimage function, which has a buffer overflow risk...

Missing 'Expect-CT' Header (deprecated)

The Expect-CT header allows sites to opt in to reporting and or enforcement of Certificate Transparency requirements, which prevents the use of misissued certificates for that site from going unnoticed. This URL is flagged as a specific example. The Expect-CT will likely become obsolete in June...

Prototype Pollution

Overview All versions of lutils-merge are vulnerable to Prototype Pollution. The merge function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with...

Fedora 30 : php-pecl-imagick (2019-488d0f9a4b)

Version 3.4.4 - The 3.4.4 release is intended to be the last release other than small bug fixes that will support either PHP 5.x, or ImageMagick 6.x. The next planned release will be PHP 7.0 and ImageMagick 7.0 at least, if not higher. - Added: - function Imagick::optimizeImageTransparency -...

Fedora 28 : php-pecl-imagick (2019-9448fa46f3)

Version 3.4.4 - The 3.4.4 release is intended to be the last release other than small bug fixes that will support either PHP 5.x, or ImageMagick 6.x. The next planned release will be PHP 7.0 and ImageMagick 7.0 at least, if not higher. - Added: - function Imagick::optimizeImageTransparency -...

Oracle Java File Detection for Windows (deprecated)

The host contains one or more java executables. This plugin has been deprecated. unmanagedsoftwarewindows.nbin plugin ID 921433 is used instead. Binary data sunjavasearch.nbin...

Fedora 30 : php-twig2 (2019-c7c03cd449)

Version 2.7.2 2019-03-12 - added TemplateWrapper::getTemplateName ---- Version 2.7.1 2019-03-12 - fixed class aliases ---- Version 2.7.0 2019-03-12 - fixed sandbox security issue under some circumstances, calling the toString method on an object was possible even if not allowed by the security...

Fedora 30 : python2 / python2-docs (2019-0c91ce7b3c)

The remote Fedora 30 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2019-0c91ce7b3c advisory. Update legacy Python to 2.7.16. Most significant improvement is that is builds against OpenSSL 1.1.1. See upstream release announcement and changelo...

Insecure Default TLS Configuration

redbird uses an insecure default configuration for TLS. It allows TLS 1.0 connections on lib/proxy.js, which has been deprecated and known to contain security vulnerabilities...

Fedora 29 : php-twig2 (2019-a9a37fed18)

Version 2.7.2 2019-03-12 - added TemplateWrapper::getTemplateName ---- Version 2.7.1 2019-03-12 - fixed class aliases ---- Version 2.7.0 2019-03-12 - fixed sandbox security issue under some circumstances, calling the toString method on an object was possible even if not allowed by the security...

Fedora 28 : php-twig2 (2019-e86155be6e)

Version 2.7.2 2019-03-12 - added TemplateWrapper::getTemplateName ---- Version 2.7.1 2019-03-12 - fixed class aliases ---- Version 2.7.0 2019-03-12 - fixed sandbox security issue under some circumstances, calling the toString method on an object was possible even if not allowed by the security...

HackerOne: Deprecated Hacker101 coursework repository mentions Heroku App that is susceptible to takeover

Hi , I'm sure this repo on GitHub https://github.com/Hacker0x01 belong to Hackerone,inc. I've found that your docs on it mention a Heroku app breaker101.herokuapp.com which is no longer work and I could takeover it via HeroKu. Suggested Fix : Remove this app name from your docs or I can remove it...

XSS vulnerability with double-encoded entities

An XSS vulnerability CVE-2019-10010 has been identified in all previous versions of this library 0.18.2 and below. The issue has been fixed in version 0.18.3. All users should upgrade to version 0.18.3 immediately. Additionally, if your application caches the resulting HTML, please purge and/or...

GHSA-GC6C-5V9W-XMHW Downloads Resources over HTTP in nodewebkit

Affected versions of nodewebkit insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...