Moderate: Red Hat Security Advisory: curl security and bug fix update

An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

RHEL 8 : curl (RHSA-2020:4599)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4599 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...

EulerOS 2.0 SP2 : curl (EulerOS-SA-2020-2337)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl's multi API, and sets...

CVE-2020-14425: Undefined Security Weakness

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog...

Server side request forgery (ssrf)

BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field...

Template Injection

osm-static-maps is vulnerable to template injection. Lack of validation of user input into the template parameter tileserverUrl allows an attacker to inject arbitrary Javascript/HTML in a user's browser, perform requests on behalf of the user or read arbitrary local files...

PT-2020-16225

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.2.7 Description The issue allows remote authenticated users to read local files and conduct Server-Side Request Forgery SSRF attacks. This is achieved by uploading an Office document that contains a crafted UR...

[SECURITY] Fedora 33 Update: rubygem-activestorage-6.0.3.3-1.fc33

Attach cloud and local files in Rails applications...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2020-2061)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl's multi API, and sets...

USN-4537-1: Aptdaemon vulnerability

Vaisha Bernard discovered that Aptdaemon incorrectly handled the Locale property. A local attacker could use this issue to test for the presence of local files...

USN-4537-1 aptdaemon vulnerability

Vaisha Bernard discovered that Aptdaemon incorrectly handled the Locale property. A local attacker could use this issue to test for the presence of local files...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Aptdaemon vulnerability (USN-4537-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4537-1 advisory. Vaisha Bernard discovered that Aptdaemon incorrectly handled the Locale property. A local attacker could use this issue to test for the...

Information Disclosure

firefox is vulnerable to information disclosure. When a Web Extension contains the all-urls permission and performed a fetch request with mode set to same-origin, an attacker will be able to read local files...

CVE-2020-14029

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files...

CVE-2020-14029

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files...

PT-2020-13853

Name of the Vulnerable Software and Affected Versions Ozeki NG SMS Gateway versions prior to 4.17.7 Description The issue is related to the RSS To SMS module processing XML files in an unsafe manner, making the application susceptible to an XML External Entity attack. This can be exploited to...

CVE-2020-11579

An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php part of the installation process allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled...

CVE-2020-11579

Summary: CVE-2020-11579 affects Chadha PHPKB 9.0 Enterprise Edition. The vulnerability is in installer/test-connection.php (installation flow) allowing an unauthenticated remote attacker to disclose local files on hosts running PHP < 7.2.16 or where MySQL ALLOW LOCAL DATA INFILE is enabled. Do...

CVE-2020-11579

An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php part of the installation process allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled...

pocsuite3-1

This is a PoC Proof of Concept framework for vulnerability testing and penetration testing, developed by the Knownsec 404 Team. The framework is called pocsuite3. The framework has a powerful proof-of-concept engine and many features for penetration testers and security researchers. It supports...