Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, groupnew.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp...

RIPS 3.3: Scaling Security Testing to Large Teams

Data Center Edition Automated security testing with RIPS is typically performed when a new code feature is merged into the development branch. But when security scanning is shifted left to the developers who scan every single code commit, the total amount of scans increases significantly. As a...

CVE-2019-18856

A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use element is mishandled...

CVE-2019-18856

A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use element is mishandled...

Denial of service

A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use element is mishandled...

CVE-2008-5083

In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON...

QEMU: qxl: null pointer dereference while releasing spice resources

interfacereleaseresource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference...

QEMU: qxl: null pointer dereference while releasing spice resources

interfacereleaseresource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference...

Presentation Template: Build Your 2020 Security Plan

As the end of the year approaches, security decision makers are creating their 2020 plans and running them by management for approval. In most cases, this means requesting and making the case for the necessary resources that need to be allocated, while still providing value to the organization. T...

QEMU: qxl: null pointer dereference while releasing spice resources

interfacereleaseresource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference...

Denial Of Service (DoS)

handlebars is vulnerable to denial of service. A bug in matching of templates can cause an infinite loop due to greedy matching of raw-block-contents. This could potentially be abused by submitting malicious templates to cause a denial of service condition when system resources are exhausted...

RHEL 8 : virt:rhel (RHSA-2019:3345)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3345 advisory. Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contai...

QEMU: qxl: null pointer dereference while releasing spice resources

interfacereleaseresource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference...

Milesight IP security cameras authorization issue vulnerability

Milesight IP security cameras are IP camera products from China Pulse Digital Technology Milesight. A security vulnerability exists in Milesight IP security cameras version 2016-11-14 and earlier. An attacker can exploit the vulnerability to bypass authentication and access protected resources...

OPENSUSE-SU-2019:2425-1 Security update for chromium, re2

This update for chromium, re2 fixes the following issues: Chromium was updated to 78.0.3904.70 boo1154806: CVE-2019-13699: Use-after-free in media CVE-2019-13700: Buffer overrun in Blink CVE-2019-13701: URL spoof in navigation CVE-2019-13702: Privilege elevation in Installer CVE-2019-13703: URL b...

Resources for Measuring Cybersecurity

Kathryn Waldron at R Street has collected all of the different resources and methodologies for measuring cybersecurity...

Denial of Service

Overview Affected versions of handlebars are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service. Recommendation Upgrade to version...

The vulnerability of the HTTP/2 network protocol implementation in the Apache HTTP Server allows for uncontrolled resource consumption, enabling attackers to cause service failures.

The vulnerability of the HTTP/2 network protocol implementation in the Apache HTTP Server is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

IBM Security Guardium Big Data Intelligence Information Disclosure Vulnerability (CNVD-2019-38279)

IBM Security Guardium Big Data Intelligence SonarG is a suite of big data security intelligence solutions from IBM, USA. The solution features interactive data exploration, automated connectivity analysis, and user activity analysis. A security vulnerability exists in IBM Security Guardium Big Da...

kubernetes: API server allows access to cluster-scoped custom resources as if resources were namespaced

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with...