CVE-2020-10595

A flaw was found during prompting initiated by the Kerberos library, where an attacker who enters a response exactly as long as the length of the buffer provided by the underlying Kerberos library, causes pam-krb5 to write a single null byte past the end of that buffer. This flaw results in heap...

Microsoft NET USE win10 - Insufficient Authentication Logic

Title: Microsoft NET USE win10 - Insufficient Authentication Logic Date: 2020-04-04 Author: hyp3rlinx Vendor: www.microsoft.com CVE: N/A + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

Users Prompted for Credentials on Workspace URLs When Using Federated Authentication Providers

Overview: Users may be prompted for additional authentication when navigating to Citrix Workspace URLS if Workspace is configured to use a federated identity provider. Example: Users may be prompted for Azure AD credentials when Using AAD for Authentication to Citrix Workspace, even if the user h...

Security Bulletin: A security vulnerability has been identified in Tivoli Netcool/OMNIbus WebGUI shipped with IBM Operations Analytics Predictive Insights (CVE-2020-4196)

Summary Tivoli Netcool/OMNIbus WebGUI is shipped as a component of IBM Operations Analytics Predictive Insights. Information about a security vulnerability affecting Tivoli Netcool/OMNIbus WebGUI has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss...

node-prompt-here injection vulnerability

node-prompt-here is a package for opening a console window in a given directory. A security vulnerability exists in node-prompt-here 1.0.1 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary commands...

CVE-2020-7602

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...

CVE-2020-7602

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...

CVE-2020-7602

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...

CVE-2020-7602

CVE-2020-7602 relates to node-prompt-here up to version 1.0.1 where the runCommand() in linux/manager.js is invoked by getDevices(), which is tied to index.process.env.NM_CLI. The argument to execSync() is constructed unsafely and controllable by users, enabling arbitrary command execution (OS co...

CVE-2020-7602

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...

PT-2020-19648

Name of the Vulnerable Software and Affected Versions node-prompt-here versions 1.0.0 through 1.0.1 Description The issue allows execution of arbitrary commands. The runCommand function is called by the getDevices function in the file linux/manager.js, which is required by the index.js process...

CVE-2020-7602: Improper Neutralization of Special Elements used in an OS Command

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...

sulu-file-system-view-prompt-here (>=1.0.2, <=1.0.4) potentially affected by CVE-2020-7602 via node-prompt-here (1.0.1)

node-prompt-here NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on node-prompt-here and may be impacted: - sulu-file-system-view-prompt-here =1.0.2, =1.0.4 Source cves: CVE-2020-7602 Source advisory: SNYK:JS-NODEPROMPTHERE-560115...

Command Injection

Overview node-prompt-here is a package to open a console window at given absolute directory. Affected versions of this package are vulnerable to Command Injection. The runCommand is called by getDevices function in file linux/manager.js, which is required by the index. process.env.NMCLI in the fi...

Information Disclosure

github.com/grafana/grafana is vulnerable to information disclosure. The attack is possible because it does not securely store the passwords for data sources, allowing a user with administrative privilege to disclose the passwords by pressing the "Save and test" button within a data source's...

CVE-2020-10106

CVE-2020-10106 affects PHPGurukul Daily Expense Tracker System 1.0. The Red Hat/NVD entries confirm a SQL injection via the email parameter in index.php or register.php, enabling dumping of the MySQL database and bypassing the login prompt. The vulnerability is driven by improper handling of user...

Security Bulletin: Cross-Site Scripting (XSS) vulnerability have been identified on Tool Prompt Configuration page of Tivoli Netcool/OMNIbus WebGUI (CVE-2020-4196)

Summary Fix is available for vulnerability in Cross-Site Scripting XSS affecting Tivoli Netcool/OMNIbus WebGUI Tool Prompt Configuration page CVE-2020-4196. Vulnerability Details CVEID: CVE-2020-4196 DESCRIPTION: IBM Tivoli Netcool/OMNIbusGUI is vulnerable to cross-site scripting. This...

Microsoft Surface Hub Security Feature Bypass Vulnerability

Surface Hub is a smart, multi-touch, large-screen collaboration device. Surface Hub has a security feature bypass vulnerability in the input credential prompt. An attacker could exploit the vulnerability to access settings that are accessible to administrators...

openSUSE Security Update : sudo (openSUSE-2020-244)

This update for sudo fixes the following issues : Security issue fixed : - CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202. Non-security issue fixed : - Fixed an issue where sudo -l would ask for a password...

openSUSE: Security Advisory for sudo (openSUSE-SU-2020:0244-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...