Ubuntu 18.04 LTS / 20.04 LTS : SPICE vdagent vulnerabilities (USN-4617-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4617-1 advisory. Matthias Gerstner discovered that SPICE vdagent incorrectly handled the activexfers hash table. A local attacker could possibly use this issu...

SonicWall SMA100 Directory Traversal (CVE-2019-7483)

A directory traversal vulnerability exists in SonicWall SMA100 system. Successful exploitation of this vulnerability could lead to disclosure of file contents accessible by the unauthenticated user...

Advantech WISE-PaaS/RMM XML External Entity Injection (CVE-2019-18227)

An XML external entity injection vulnerability exists in Advantech WISE-PaaS/RMM. Successful exploitation of this vulnerability could result in the disclosure of file contents from the target system...

"File contents" option is always selectable, Start screen becomes blank, or computer freezes when startup in Windows 8.1

"File contents" option is always selectable, Start screen becomes blank, or computer freezes when startup in Windows 8.1 This article describes an issue in which the File contents option is always selectable, Start screen becomes blank, or computer freezes during startup in Windows 8.1, Windows R...

Advantech WebAccess/NMS getSyslogUiList SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processi...

Advantech WebAccess/NMS setDevicechoose SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processi...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getLinkMonitor method of the DBUtil class...

Advantech WebAccess/NMS MibBrowser SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the handleTargetsByDeviceName method of the...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getDeviceOidStrT method of the DBUtil...

Advantech WebAccess/NMS getFWUpgradeInfo SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processi...

SUSE-SU-2020:0806-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2020-1938: Fixed a file contents disclosure vulnerability bsc1164692...

openSUSE Security Update : tomcat (openSUSE-2020-345)

This update for tomcat to version 9.0.31 fixes the following issues : Security issues fixed : - CVE-2019-17569: Fixed a regression in the handling of Transfer-Encoding headers that would have allowed HTTP Request Smuggling bsc1164825. - CVE-2020-1935: Fixed an HTTP Request Smuggling issue...

Security update for tomcat (important)

openSUSE Security Update: Security update for tomcat Announcement ID: openSUSE-SU-2020:0345-1 Rating: important References: 1164692 1164825 1164860 Cross-References: CVE-2019-17569 CVE-2020-1935 CVE-2020-1938 Affected Products: openSUSE Leap 15.1 An update that fixes three vulnerabilities is now...

SUSE-SU-2020:0631-1 Security update for tomcat

This update for tomcat to version 9.0.31 fixes the following issues: Security issues fixed: - CVE-2019-17569: Fixed a regression in the handling of Transfer-Encoding headers that would have allowed HTTP Request Smuggling bsc1164825. - CVE-2020-1935: Fixed an HTTP Request Smuggling issue bsc116486...

SUSE-SU-2020:0598-1 Security update for tomcat

This update for tomcat to version 9.0.31 fixes the following issues: Security issues fixed: - CVE-2019-17569: Fixed a regression in the handling of Transfer-Encoding headers that would have allowed HTTP Request Smuggling bsc1164825. - CVE-2020-1935: Fixed an HTTP Request Smuggling issue bsc116486...

Directory Traversal Vulnerability in PageAdmin CMS

PageAdmin CMS is a self-service website builder based on asp.net mvc development . PageAdmin CMS has a directory traversal vulnerability that can be exploited by an attacker to view the structure of the server file system and file contents...

GitLab Information Disclosure Vulnerability (CNVD-2020-03764)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

Cisco Prime Infrastructure and EPNM Directory Traversal (CVE-2019-1819)

A directory traversal vulnerability exists in Cisco Prime Infrastructure and Evolved Programmable Network Manager. The vulnerability is due to a lack of proper validation of a user-supplied path prior to using it in file operations. Successful exploitation results in the disclosure of file conten...

Arbitrary File Read Vulnerability in CmsEasy

Ltd. CmsEasy easy to pass enterprise website system, also known as easy to pass enterprise website program, is easy to pass the company to develop China's first set of free enterprise website templates for marketing enterprise website management system, the system foreground to generate html, ful...

CVE-2009-0842

mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink...