Fedora 30 : php-symfony (2019-0ef4149687)

Version 2.8.50 2019-04-17 - security cve-2019-10910 DI Check service IDs are valid nicolas-grekas - security cve-2019-10909 FrameworkBundleForm Fix XSS issues in the form theme of the PHP templating engine stof - security cve-2019-10912 PHPUnit Bridge Prevent destructors with side-effects from...

Fedora 29 : php-symfony4 (2019-32067d8b15)

Version 4.1.12 2019-04-17 - security cve-2019-10910 DI Check service IDs are valid nicolas-grekas - security cve-2019-10909 FrameworkBundleForm Fix XSS issues in the form theme of the PHP templating engine stof - security cve-2019-10912 CachePHPUnit Bridge Prevent destructors with side-effects fr...

Fedora 29 : php-symfony3 (2019-a3ca65028c)

Version 3.4.26 2019-04-17 - bug 31084 HttpFoundation Make MimeTypeExtensionGuesser case insensitive vermeirentony - bug 31142 Revert 'bug 30423 Security Rework firewall's access denied rule dimabory' chalasr - security cve-2019-10910 DI Check service IDs are valid nicolas-grekas - security...

DRUPAL-CORE-2019-005

This security release fixes third-party dependencies included in or required by Drupal core. CVE-2019-10909: Escape validation messages in the PHP templating engine. From that advisory: Validation messages were not escaped when using the form theme of the PHP templating engine which, when...

drupal -- Drupal core - Moderately critical

Drupal Security Team reports: CVE-2019-10909: Escape validation messages in the PHP templating engine. CVE-2019-10910: Check service IDs are valid. CVE-2019-10911: Add a separator in the remember me cookie hash. jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extendtrue...

CVE-2019-10907

Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users...

CVE-2019-10907

Airsonic 10.2.1 is affected. The CVE describes that Spring’s remember-me feature is used with MD5 and a fixed key (class GlobalSecurityConfig.java, key: uitstairsonic? actually the document says fixed key of airsonic). An attacker who can capture cookies could offline-bruteforce user passwords. T...

CVE-2018-12192

Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or IntelR Server Platform Services before version SPSE504.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access...

ESPCMS P8 Me***.php page has xss vulnerability

ESPCMS is an enterprise website management system built on LAMP development. An xss vulnerability exists in the ESPCMS P8 Me.php page. Attackers can use the vulnerability to obtain cookie access when logging into the background as an administrator...

jenkins: cookie crafted using Jenkins script console allows unauthorised access to Jenkins instance

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g...

CloudBees Jenkins Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

CloudBees Jenkins Code Issue Vulnerability (CNVD-2020-20405)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

Authorization

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g...

PT-2019-2981 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.158 and earlier Jenkins LTS versions 2.150.1 and earlier Description: The issue is related to an improper authorization vulnerability in the TokenBasedRememberMeServices2.java component. This vulnerability allows attackers...

Authentication Bypass

github.com/grafana/grafana is vulnerable to authentication bypass. An attacker is able to generate a valid remember me cookie via the Login function with only the username of a user without a local Grafana password LDAP & OAuth users and gain access to the application...

tvnamu15.me XSS vulnerability

Open Bug Bounty ID: OBB-719971 Description| Value ---|--- Affected Website:| tvnamu15.me Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

grafana: authentication bypass knowing only a username of an LDAP or OAuth user

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user...

ifun88.me XSS vulnerability

Open Bug Bounty ID: OBB-716974 Description| Value ---|--- Affected Website:| ifun88.me Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

D-Link DSL-2770L Administrator Credentials Disclosure Vulnerability

The D-Link DSL-2770L is a wireless router from AUO D-Link. A security vulnerability exists in the atbox.htm file in the D-Link DSL-2770L ME1.01 version, ME1.02 version, and AU1.06 version. An attacker can exploit the vulnerability to disclose admin credentials...

grafana: authentication bypass knowing only a username of an LDAP or OAuth user

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user...