QuantConnect Lean versions from 代码问题漏洞

Quantconnect Lean is a cross-platform algorithmic trading engine for strategy research, backtesting and real-time trading based on the C language from Quantconnect. A security vulnerability exists in QuantConnect Lean versions 2.3.0.0 through 2.4.0.1, which stems from a failure to securely...

Vulnerability fixed in Drupal

A vulnerability has been fixed in Drupal core. Drupal core does not handle some file names correctly. As a result, it is possible for files to be misinterpreted and executed under the wrong MIME type or executed as PHP. This applies to a number of configurations; which ones these are is not...

The command-line interface of SUSE Linux Enterprise Software Development Kit and SUSE Linux Enterprise Module for Development Tools exposes clients to vulnerabilities, allowing attackers to exploit these privileges.

The vulnerability of the command-line interface of SUSE Linux Enterprise Software Development Kit and SUSE Linux Enterprise Module for Development Tools relates to improper external management of file names or paths. Exploiting this vulnerability can allow a malicious actor to gain increased...

UBUNTU-CVE-2017-9109

An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the...

Moxa AWK-3131A Authentication Bypass Vulnerability

Moxa AWK-3131A is a wireless access device from Moxa. A security vulnerability exists in the handling of host names in the Moxa AWK-3131A using firmware version 1.13. An attacker can exploit this vulnerability to bypass authentication by sending an authenticated SNMP request...

FlightGear flightgear/src/Environment/fgclouds.cxx Cloud Name Handling Remote Format String

FlightGear contains a format string flaw in flightgear/src/Environment/fgclouds.cxx. The issue is triggered as format string specifiers e.g. %s and %x are not properly sanitized in user-supplied input during the handling of a specially crafted cloud name. This may allow a remote attacker to cause...

PYSEC-2018-18

Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely...

SUSE-SU-2018:1652-1 Security update for slurm

This update for slurm to version 17.02.11 fixes the following issues: This security issue was fixed: - CVE-2018-10995: Ensure proper handling of user names aka username fields and group ids aka gid fields bsc1095508. This non-security issue was fixed: - Move config files to slurm-config package t...

gifsicle 'read_gif' function double release vulnerability

gifsicle is an open source tool for creating, editing and optimizing GIF images. A double-release vulnerability exists in the 'readgif' function of the gifread.c file in gifsicle version 1.90, which stems from the program's failure to handle lastname correctly.A remote attacker can exploit this...

UBUNTU-CVE-2017-15088

plugins/preauth/pkinit/pkinitcryptoopenssl.c in MIT Kerberos 5 aka krb5 through 1.15.2 mishandles Distinguished Name DN fields, which allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow and application crash in situations involving untrusted X.509 data,...

USN-3387-1 git vulnerability

Brian Neel, Joern Schneeweisz, and Jeff King discovered that Git did not properly handle host names in 'ssh://' URLs. A remote attacker could use this to construct a git repository that when accessed could run arbitrary code with the privileges of the user...

The vulnerability of Samba software allows a remote attacker to compromise the confidentiality and integrity of protected information.

A vulnerability exists in the winbindnamelisttosidstringlist function in nsswitch/pamwinbind.c of Samba, due to the handling of incorrect group names like requiremembershipof. This allows authentication for any user. Exploiting this vulnerability enables remote users to circumvent access...

Apache Cordova plugin cordova-plugin-file-transfer vulnerable to HTTP header injection

Overview cordova-plugin-file-transfer, a plugin for Apache Cordova provided by the Apache Software Foundation, provides functionality to upload and download files in applications created by Apache Cordova. It also provides functionality to add HTTP headers. Android applications that use...

DEBIAN-CVE-2015-1270

The ucnviogetConverterName function in common/ucnvio.cpp in International Components for Unicode ICU, as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service read of uninitialized memory or...

The vulnerability of the SELinux access control system, allowing a perpetrator to execute arbitrary commands

The vulnerability of the SELinux access control system is related to improper handling of file names. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands by adding special metafiles to file names...

TransmitMail vulnerable to directory traversal

Overview TransmitMail is a PHP based mail form. TransmitMail contains an issue in processing file names, which may result in a directory traversal CWE-22 vulnerability. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer und...

TransmitMail vulnerable to cross-site scripting

Overview TransmitMail is a PHP based mail form. TransmitMail contains a cross-site scripting CWE-79 vulnerability due to the processing of file names. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

Asterisk Open Source/Certified Asterisk Certificate Validation Vulnerability

Asterisk is a free software, open source software that implements the functionality of a telephone user switch PBX. Asterisk Open Source has a security vulnerability due to a failure to properly handle domain names in the CN field of an X.509 certificate when registering a SIP TLS device. Allowin...

PT-2015-1273 · Red Hat +1 · Setroubleshoot +2

Name of the Vulnerable Software and Affected Versions: setroubleshoot versions prior to 3.2.22 Description: The issue is related to incorrect file name handling, which can be exploited by remote attackers to execute arbitrary commands by adding shell metacharacters to file names. This is...

OracleVM 2.2 : glibc (OVMSA-2015-0024) (GHOST)

The remote OracleVM system is missing necessary patches to address critical security updates : - Switch to use malloc when the input line is too long Orabug 19951108 - Use a /sys/devices/system/cpu/online for SCNPROCESSORSONLN implementation Orabug 17642251 Joe Jin - Fix parsing of numeric hosts ...