PYSEC-2020-40

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

CVE-2020-10594

CVE-2020-10594 affects drf-jwt 1.15.x before 1.15.1. The issue stems from an incompatibility between the blacklist protection mechanism and the token-refresh feature, allowing an attacker who has access to a notionally invalidated token to obtain a new, valid token via the refresh endpoint. The d...

CVE-2020-10594

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

DEBIAN-CVE-2018-19516

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

CVE-2018-19516

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

CVE-2018-19516

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

Design/Logic Flaw

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

UBUNTU-CVE-2018-19516

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

CVE-2018-19516

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

CVE-2018-19516

CVE-2018-19516 affects KDE Applications’ messagelib (messagepartthemes/default/defaultrenderer.cpp) prior to version 18.12.0, where http-equiv=REFRESH handling is not properly restricted, potentially allowing data access bypass. Public records in NVD confirm the issue and indicate downstream patc...

CVE-2018-19516

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

Poor Rowhammer Fixes On DDR4 DRAM Chips Re-Enable Bit Flipping Attacks

Remember rowhammer vulnerability? A critical issue affecting modern DRAM dynamic random access memory chips that could allow attackers to obtain higher kernel privileges on a targeted system by repeatedly accessing memory cells and induce bit flips. To mitigate Rowhammer vulnerability on the late...

CVE-2020-10255

The CVE-2020-10255/TRRRespass issue affects modern memory (DDR4/LPDDR4 after 2015) where Target Row Refresh mitigations can be bypassed by rowhammer patterns. Documents in connected sources confirm this can allow privilege escalation, kernel/Sudo compromise, and cross-tenant VM access via bit fli...

CVE-2019-17645

An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/service/refreshMacroAjax.php...

SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2020:0466-1)

This update for java-180-ibm fixes the following issues : Java 8.0 was updated to Service Refresh 6 Fix Pack 5 bsc1162972, bsc1160968 CVE-2020-2583: Unlink Set of LinkedHashSets CVE-2019-4732: Untrusted DLL search path vulnerability CVE-2020-2593: Normalize normalization for all CVE-2020-2604:...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM® SDK, Java™ Technology Edition shipped with IBM Tivoli Business Service Manager October 2019 CPU

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Tivoli Business Service Manager. Information about a security vulnerability affecting IBM® SDK, Java™ Technology Edition has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss...

Nextcloud Server < 12.0.8, < 13.0.3 Improper Input Vulnerability (NC-SA-2018-003)

Nextcloud Server is prone to an improper input vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Merge + Minify + Refresh < 1.10.7 - Authenticated Arbitrary File Delete

The plugin relied on the isadmin check, without checking the user's capabilities, when deleting arbitrary files. The functionality was also vulnerable to Cross-site Request Forgery CSRF allowing attackers to delete arbitrary files by tricking authenticated users into visiting a page they...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM InfoSphere Identity Insight on Windows platforms (CVE-2019-4732)

Summary There is a vulnerability in the IBM Java SDK that is used by IBM WebSphere Application Server shipped as part of IBM InfoSphere Identity Insight. This vulnerability affects Windows platforms only. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes secti...

WordPress Merge + Minify + Refresh plugin <= 1.10.6 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by NinTechNet in WordPress Merge + Minify + Refresh plugin versions = 1.10.6. Solution Update the WordPress Merge + Minify + Refresh plugin to the latest available version at least 1.10.7...