PT-2019-17690

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 11.11.6 GitLab versions prior to 12.0.4 GitLab versions prior to 12.1.2 Description An input validation issue was found in the GitHub service integration, allowing an attacker to make arbitrary POST requests within a...

CVE-2019-5461: Improper Input Validation

An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

Elderly China Chopper Tool Still Going Strong in Multiple Campaigns

A nine-year-old web shell used for providing remote access to web servers for cyberattackers is staying very active despite its advanced age in cyber-years, anyway. Researchers said they’ve spotted it being used in several recent campaigns – all with disparate goals. The tool, known as China...

Security update for MozillaThunderbird (moderate)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2019:1990-1 Rating: moderate References: 1137970 1140868 Cross-References: CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729...

The vulnerability of the page handler /api/cmdb web interface of the FortiOS operating system allows attackers to execute cross-site scripting attacks.

The vulnerability of the page handler /api/cmdb web interface of the FortiOS operating system is related to errors during HTTP request filtering. Exploiting this vulnerability allows a malicious actor to perform cross-site attacks using specially crafted POST requests sent to the /api/cmdb page...

The vulnerability of the page handler /login_disconnect/current_admins in the FortiOS operating system allows a hacker to upload arbitrary files to the device.

The vulnerability of the /logindisconnect/currentadmins page handler in the FortiOS operating system is related to access control errors. Exploiting this vulnerability allows a malicious actor to upload arbitrary files to a device using specially crafted POST requests...

Denial of Service

Overview Versions of parse-server prior to 3.4.1 are vulnerable to Denial of Service DoS. POST requests to /parse/classes/Audience or other volatile classes cause the server to respond with a 500 Internal Server Error for any subsequent POST requests. Recommendation Upgrade to version 3.4.1 or...

openSUSE Security Update : MozillaThunderbird (openSUSE-2019-1813)

This update for MozillaThunderbird version 60.8 fixes the following issues : Security issues fixed : - CVE-2019-9811: Sandbox escape via installation of malicious language pack bsc1140868. - CVE-2019-11711: Script injection within domain through inner window reuse bsc1140868. - CVE-2019-11712:...

openSUSE Security Update : MozillaFirefox (openSUSE-2019-1811)

This update for MozillaFirefox, mozilla-nss fixes the following issues : MozillaFirefox to version ESR 60.8 : - CVE-2019-9811: Sandbox escape via installation of malicious language pack bsc1140868. - CVE-2019-11711: Script injection within domain through inner window reuse bsc1140868. -...

openSUSE: Security Advisory for MozillaThunderbird (openSUSE-SU-2019:1813-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CSRF vulnerability in m2release

m2release did not require that requests sent to the endpoint used to initiate the release process use POST. This resulted in a cross-site request forgery vulnerability that allows attackers to perform releases. m2release now requires that these requests be sent via POST...

Denial Of Service (DoS)

parse-server is vulnerable to denial of service DoS. The attack exists when a post request is made against a volatile class such as /parse/classes/Audience, returning 500 an internal server error for subsequent POST requests...

openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2019:1811-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

The vulnerability of the automated personal data management system “Tula” lies in its ability to load files of a harmful type without limitation, allowing an attacker to execute arbitrary code.

The vulnerability of the automated personal data management system “Tula” is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a specially crafted file onto the server using a specially crafted POST...

Security update for MozillaThunderbird (important)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2019:1813-1 Rating: important References: 1140868 Cross-References: CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729 CVE-2019-11730...

CVE-2019-11712

POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery CSRF attacks. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...

CVE-2019-11712

POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery CSRF attacks. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...

CVE-2019-11712

POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery CSRF attacks. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...

CentOS Update for thunderbird CESA-2019:1777 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 8 : thunderbird (RHSA-2019:1799)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1799 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.8.0. Security Fixes: Mozilla:...