CVE-2019-15113

CVE-2019-15113 affects the WordPress plugin companion-sitemap-generator (before 3.7.0). Multiple sources confirm a CSRF vulnerability in this plugin, enabling unauthorized actions from forged requests. The NVD entry lists CVSS v3 base score 8.8 (HIGH) with network attack vector, low attack comple...

bind security, bug fix, and enhancement update

32:9.11.4-9.P2 - Fix CVE-2019-6471 32:9.11.4-8.P2 - Fix scriptlet errors when selinux-policy is not installed 1647659 32:9.11.4-7.P2 - Fix inefective limit of TCP clients CVE-2018-5743 32:9.11.4-6.P2 - Use /sbin/nologin again 1676661 32:9.11.4-5.P2 - Make sure selinux-policy is installed soon...

CVE-2017-18486

Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote...

CVE-2019-7860

A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

CVE-2019-7860

Magento 2.x releases before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2 are affected by a cryptographically weak PRNG used in security-relevant contexts. The root cause is insufficient randomness in generation routines across multiple components, which can undermine cryptographic operations an...

CVE-2019-7860

A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

WordPress WPS Child Themes Generator plugin <= 1.1 - Path Traversal vulnerability

Path Traversal vulnerability found by Julio Potier in WordPress WPS Child Themes Generator plugin versions = 1.1. Solution Update the WordPress WPS Child Themes Generator plugin to the latest available version at least 1.2...

UBUNTU-CVE-2019-9818

A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main process, resulting in a potentially exploitable crash and a sandbox escape. Note: this vulnerability only affects Windows. Other operating...

Access Control Vulnerabilities in Multiple ZyXEL Products

ZyXEL ZyWall 310 and others are products of Taiwan, China-based ZyXEL Corporation.ZyXEL ZyWall 310 is a 310 series VPN firewall appliance.ZyXEL ZyWall 110 is a 110 series VPN firewall appliance.ZyXEL USG1900 is a next-generation unified security gateway appliance. A security vulnerability exists ...

UPDATE: Ostinato 0.9!

PenTestIT RSS Feed This tool came to my rescue yet again today! If you remember, I had blogged about this tool in my older post titled - Ostinato: The Network Traffic Generator and Analyzer! As always, before using any tool I tried to update it and there it was - Ostinato 0.9. This update was...

SQL Injection

sequelize is vulnerable to sql injection attacks. The attacks are possible because the library does not escape the JSON path key provided by the user using postgres dialects in query-generator.js...

Getwin - FUD Win32 Payload Generator And Listener

FUD Win32 payload generator and listener Legal disclaimer: Usage of GetWin for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse ...

[SECURITY] Fedora 30 Update: rust-1.34.2-1.fc30

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service DoS attacks. The vulnerability exists in the Linux kernel's random number generator API. Attackers could cause a denial of service because of a null pointer dereference in the rngapireset function...

PT-2019-6812 · Chicken +1 · Chicken +1

Name of the Vulnerable Software and Affected Versions: Chicken versions prior to 4.8.0 Description: A casting error caused the random number generator to return a constant value on 64-bit platforms. The vendor notes that this function was not used for security purposes and is advertised as being...

EulerOS Virtualization 3.0.1.0 : libgcrypt (EulerOS-SA-2019-1448)

According to the version of the libgcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A design flaw was found in the libgcrypt PRNG Pseudo-Random Number Generator. An attacker able to obtain the first 580 bytes of th...

Siemens SIMATIC S7-1200 PLCs < 4.0 Random Number Generator Insufficient Entropy

Binary data 720193.prm...

Siemens SIMATIC S7-1500 PLCs < 1.5 Random Number Generator Insufficient Entropy

Binary data 720194.prm...

Insecure Default Configuration

graphql-code-generator contains an insecure default configuration. SSL certificate verification was disabled by default, allowing man-in-the-middle MitM attacks...

Insecure Default Configuration

Overview Versions of graphql-code-generator prior to 0.18.2 have an Insecure Default Configuration. The packages sets NODETLSREJECTUNAUTHORIZED to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process. Recommendation Upgrade to versio...