PT-2019-17490

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6 Description The issue allows for SQL injection attacks in the authenticated section of the software. An attacker can craft special web requests to inject SQL code, potentially exploiting the uuid parameter in the...

CVE-2019-5129: Improper Neutralization of Special Elements used in an OS Command

A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in...

CVE-2019-5122: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.json.php...

CVE-2019-5121: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter uuid in /objects/pluginSwitch.json.php...

CVE-2019-5123: Improper Neutralization of Special Elements used in an SQL Command

Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php...

PT-2019-17495

Name of the Vulnerable Software and Affected Versions YouPHPTube Encoder version 2.3 Description A command injection issue has been discovered, which could allow an attacker to compromise the server. The issue is related to an unauthenticated command injection in the base64Url parameter of the...

PT-2019-17494

Name of the Vulnerable Software and Affected Versions YouPHPTube Encoder version 2.3 Description A command injection issue has been discovered, which could allow an attacker to compromise the server. The issue is related to an unauthenticated command injection in the base64Url parameter of the...

PT-2019-17491

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6 Description The issue allows for SQL injection attacks in the authenticated section. An attacker can craft special web requests to inject SQL code, potentially exploiting the Parameter name in the...

PT-2019-17492

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6 Description The issue allows specially crafted web requests to cause SQL injections. An attacker can exploit this by sending a web request with the dir parameter in the "/objects/pluginSwitch.json.php" endpoint...

CVE-2019-15939

A divide by zero vulnerability was found in OpenCV in the way HOGDescriptor objects are created by loading their properties from a local file. Local files with no "cellSize" property may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially crafted file tha...

jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using MyBatis classes when using DefaultTyping. An attacker could use this flaw to achieve content exfiltration and possibly conduct further attacks...

SUSE SLED12 / SLES12 Security Update : binutils (SUSE-SU-2019:2650-1)

This update for binutils fixes the following issues : binutils was updated to current 2.32 branch @7b468db3 jscECO-368 : Includes the following security fixes : CVE-2018-17358: Fixed invalid memory access in bfdstabsectionfindnearestline in syms.c bsc1109412 CVE-2018-17359: Fixed invalid memory...

NewStart CGSL CORE 5.04 / MAIN 5.04 : sssd Multiple Vulnerabilities (NS-SA-2019-0195)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sssd packages installed that are affected by multiple vulnerabilities: - A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' the root directory instead of '' the emp...

CVE-2018-14667

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData...

Amazon Linux AMI : sssd (ALAS-2019-1307)

A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.CVE-2018-16838 A vulnerability was found in sssd where, if a us...

CVE-2019-1369

An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclave SDK Information Disclosure Vulnerability'...

CVE-2019-1359

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1358...

CVE-2019-1337

An information disclosure vulnerability exists when Windows Update Client fails to properly handle objects in memory, aka 'Windows Update Client Information Disclosure Vulnerability'...

CVE-2019-1343

A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-1346, CVE-2019-1347...

CVE-2019-1345

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1334...