openSUSE Security Update : pdns (openSUSE-2019-1128)

This update for pdns fixes the following issue : Security issue fixed : - CVE-2019-3871: Fixed an insufficient validation in the HTTP remote backend which could allow a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one bsc1129734...

Debian: Security Advisory (DLA-1737-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Authentication Bypass in PAN-OS Management Web Interface

An Authentication Bypass vulnerability exists in the PAN-OS Management Web Interface. Ref PAN-113675, CVE-2019-1572 Successful exploitation of this issue may allow an unauthenticated remote user to access php files. This issue affects Only PAN-OS 9.0.0 Work around: This issue affects the web-base...

CVE-2019-9917

ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service crash via invalid encoding...

Design/Logic Flaw

ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service crash via invalid encoding...

CVE-2019-9917

ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service crash via invalid encoding...

CVE-2019-9917

CVE-2019-9917 affects ZNC prior to 1.7.3-rc1, enabling an authenticated or remote user to crash the server via invalid encoding (Denial of Service). The issue is caused by improper handling of encoding in ZNC’s components, leading to a crash under crafted input. Affected products in multiple dist...

CVE-2019-9917

ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service crash via invalid encoding...

Design/Logic Flaw

PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files...

CVE-2019-1572

PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files...

Information Disclosure

Apache Tomcat is vulnerable to information disclosure. The character sequence " in a cookie value is incorrectly handled, allowing a remote user to exploit the vulnerability to obtain users' session tokens and gain access to the application as the victims...

Design/Logic Flaw

In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated...

CVE-2019-3871

A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by makin...

FreeBSD : PowerDNS -- Insufficient validation in the HTTP remote backend (6001cfc6-9f0f-4fae-9b4f-9b8fae001425)

PowerDNS developers report : An issue has been found in PowerDNS Authoritative Server when the HTTP remote backend is used in RESTful mode without post=1 set, allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one, via a crafted DNS...

PowerDNS Authoritative Server RESTful Vulnerability (2019-03)

An issue has been found in PowerDNS Authoritative Server when the HTTP remote backend is used in RESTful mode without post=1 set, allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one, via a crafted DNS query. This can be used to...

CVE-2019-3785

Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service...

CVE-2019-3776 Reflected XSS in Pivotal Operations Manager

Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with...

Cross site scripting

Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with...

Code injection

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user...

SAP J2EE Engine/7.01/Portal/EPP Protocol Cross Site Scripting

I. VULNERABILITY ------------------------- SAP J2EE Engine/7.01/Portal/EPP Reflected Cross Site Scripting XSS II. CVE REFERENCE ------------------------- CVE-2018-17861 III. VENDOR ------------------------- https://www.sap.com IV. TIMELINE ------------------------- 10/08/2018 Vulnerability...