Virtuozzo 7 : OVMF / anaconda / anaconda-core / anaconda-dracut / etc (VZA-2019-013)

According to the versions of the OVMF / anaconda / anaconda-core / anaconda-dracut / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - An integer overflow flaw was found in createelftables. An unprivileged local user with access...

DEBIAN-CVE-2018-18559

In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanoutadd from setsockopt and bind on an AFPACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain...

GHSA-8QFC-CVJP-MGPQ Moderate severity vulnerability that affects org.apache.ignite:ignite-core

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

Apache Ignite communicates to an external PHP server where sensitive information is sent

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

GHSA-8P83-68CW-943F Apache Ignite communicates to an external PHP server where sensitive information is sent

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

CSRF vulnerability and missing permission checks in Argus Notifier Plugin allowed capturing credentials

Argus Notifier Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored i...

Unprivileged users with Overall/Read access are able to enumerate credential IDs in Argus Notifier Plugin

Argus Notifier Plugin provides a list of applicable credential IDs to allow administrators configuring the plugin to select the one to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as...

CSRF vulnerability and missing permission checks in MQ Notifier Plugin

Users with Overall/Read permission were able to access MQ Notifier Plugin's form validation URL, having it connect to an attacker-specified MQ system with attacker-specified credentials. Additionally, this form validation URL did not require POST requests, resulting in a CSRF vulnerability. The...

Unprivileged users with Overall/Read access are able to enumerate credential IDs in Chatter Notifier Plugin

Chatter Notifier Plugin provides a list of applicable credential IDs to allow users configuring the plugin's functionality to select the one to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be...

CVE-2018-1999031

An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API key stored in this plugin's configuration...

@risingstack/trace (2.0.1), democracyos-notifier (>=1.3.0, <=2.1.3) +1 more potentially affected by CVE-2018-3723 via defaults-deep (0.2.3)

defaults-deep NPM version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on defaults-deep and may be impacted: - @risingstack/trace 2.0.1 - democracyos-notifier =1.3.0, =2.1.3 - oddvoter-notifier 1.1.1 Source cves: CVE-2018-3723 Source advisory:...

@risingstack/trace (2.0.1), democracyos-notifier (>=1.3.0, <=2.1.3) +1 more potentially affected by CVE-2018-3723 via defaults-deep (0.2.3)

defaults-deep NPM version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on defaults-deep and may be impacted: - @risingstack/trace 2.0.1 - democracyos-notifier =1.3.0, =2.1.3 - oddvoter-notifier 1.1.1 Source cves: CVE-2018-3723 Source advisory:...

WordPress Woocommerce Notifier Lite plugin <= 1.5.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by ThreatPress Security Research Team in WordPress Woocommerce Notifier Lite- Send automated web push desktop notifications plugin versions = 1.5.1. Solution Update the WordPress Woocommerce Notifier Lite- Send automated web push desktop...

CloudBees Jenkins Gitlab Hook Plugin Information Disclosure Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Gitlab Hook Plugin is used in one of...

PT-2018-9365

Name of the Vulnerable Software and Affected Versions Jenkins Gitlab Hook Plugin versions 1.4.2 and older Description A sensitive information exposure issue exists, allowing attackers with local Jenkins master file system access or control of a Jenkins administrator's web browser to retrieve the...

[ASA-201802-4] plasma-workspace: arbitrary command execution

Arch Linux Security Advisory ASA-201802-4 ========================================= Severity: High Date : 2018-02-09 CVE-ID : CVE-2018-6791 Package : plasma-workspace Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-607 Summary ======= The package...

CVE-2018-6791

An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains or $ in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary...

DEBIAN-CVE-2018-6791

An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains or $ in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary...

CVE-2018-6791

An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains or $ in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary...

UBUNTU-CVE-2018-6791

An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains or $ in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary...