GHSA-7XCX-6WJH-7XP2 Command Injection in standard-version

GitHub Security Lab GHSL Vulnerability Report: GHSL-2020-111 The GitHub Security Lab team has identified a potential security vulnerability in standard-version. Summary The standardVersion function has a command injection vulnerability. Clients of the standard-version library are unlikely to be...

Command Injection in standard-version

GitHub Security Lab GHSL Vulnerability Report: GHSL-2020-111 The GitHub Security Lab team has identified a potential security vulnerability in standard-version. Summary The standardVersion function has a command injection vulnerability. Clients of the standard-version library are unlikely to be...

GitHub Security Lab: [javascript] CWE-020: CodeQL query to detect missing origin validation in cross-origin communication via postMessage

This bug was reported directly to GitHub Security Lab...

CVE-2020-15092

In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Mos...

PT-2020-14177

Name of the Vulnerable Software and Affected Versions TimelineJS versions prior to 3.7.0 knight-lab-timelinejs plugin versions prior to 3.7.0.0 Description The issue allows an attacker to implement an XSS exploit with maliciously crafted content in several data fields. This risk is present whethe...

CVE-2020-15092: Improper Neutralization of Input During Web Page Generation

In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Mos...

WordPress Knight Lab Timeline plugin <= 3.6.3.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability vulnerable TimelineJS library version discovered in WordPress Knight Lab Timeline plugin versions = 3.6.3.0. Solution Update the WordPress Knight Lab Timeline plugin to the latest available version at least 3.7.0.0...

GitHub Security Lab: [Java] CWE-295 - Incorrect Hostname Verification - MitM

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query to detect OGNL injections

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: CWE-273 Unsafe certificate trust

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query for disabled revocation checking

This bug was reported directly to GitHub Security Lab...

rauLink Software Domotica Web 2.0 SQL Injection Authentication Bypass

Summary Smart home automation software. Description The application suffers from an SQL Injection vulnerability. Input passed through 'usuario' POST parameter in registraUsuario is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate...

lab-animal.jejunu.ac.kr Cross Site Scripting vulnerability OBB-1216039

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

GitHub Security Lab: Golang : Add MongoDb NoSQL injection sinks

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java : CWE-548 - J2EE server directory listing enabled

This bug was reported directly to GitHub Security Lab...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-11538 +1 more via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-11538, CVE-2020-5311 Source advisory: OSV:PYSEC-2020-80...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-10177 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-10177 Source advisory: OSV:PYSEC-2020-76...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-10379 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-10379 Source advisory: OSV:PYSEC-2020-78...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-10378 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-10378 Source advisory: OSV:PYSEC-2020-77...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.71.0-i586-1slack14.2.txz: Upgraded. This update fixes security issues: curl overwrite local file with -J 111 Partial...