PT-2020-20385

Name of the Vulnerable Software and Affected Versions Artica Pandora FMS version 7.0 Description The issue allows remote attackers to execute arbitrary OS commands via shell metacharacters in the "index.php?operation/netflow/nf live view" API endpoint, specifically in the ip dst, dst port, or src...

Ubuntu: Security Advisory (USN-4275-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-5217

A flaw was found in rubygem-secureheaders in versions prior to 6.2.0, 5.1.0, and 3.8.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection which could be used to override a script-src directive. The...

Citrix ADM Ports and URL's That Need To Be Opened for Communication

Additional notes: If using ULFD LogStream: The -logstreamOverNSIP option is available from Citrix ADC 13.0 41.x and 12.1 55.x onwards to alter the SRC IP. Default is SNIP. This is a global setting. set appflow param -logstreamOverNSIP If using IPFix AppFlow: The -IPAddress parameter can be used t...

Debian: Security Advisory (DSA-4617-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2020-6508

Name of the Vulnerable Software and Affected Versions PlaySMS versions prior to 1.4.3 Description The issue is related to insufficient sanitization of special elements in a string, which can be exploited by a remote attacker to execute arbitrary code. This is a server-side template injection...

Debian DSA-4617-1 : qtbase-opensource-src - security update

Two security issues were found in the Qt library, which could result in plugins and libraries being loaded from the current working directory, resulting in potential code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DLA-2092-1 : qtbase-opensource-src security update

In Qt5's plugin loader code as found in qtbase-opensource-src, it was possible to side-load plugins from 'the' local folder in addition to a system-widely defined library path. For Debian 8 'Jessie', this problem has been fixed in version 5.3.2+dfsg-4+deb8u4. We recommend that you upgrade your...

DSA-4617-1 qtbase-opensource-src - security update

Bulletin has no description...

[SECURITY] [DLA 2092-1] qtbase-opensource-src security update

Package : qtbase-opensource-src Version : 5.3.2+dfsg-4+deb8u4 CVE ID : CVE-2020-0569 In Qt5s plugin loader code as found in qtbase-opensource-src, it was possible to side-load plugins from "the" local folder in addition to a system-widely defined library path. For Debian 8 "Jessie", this problem...

Debian: Security Advisory (DLA-2092-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-5217

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

Code injection

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

CVE-2020-5217 Directive injection when using dynamic overrides with user input in RubyGems secure_headers

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

CVE-2020-5217: Improper Neutralization of Directives in Dynamically Evaluated Code

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

PT-2020-18313

Name of the Vulnerable Software and Affected Versions Secure Headers versions prior to 3.8.0 Secure Headers versions prior to 5.1.0 Secure Headers versions prior to 6.2.0 Description A directive injection vulnerability is present in Secure Headers. If user-supplied input was passed into...

CVE-2020-6840

In mruby 2.1.0, there is a use-after-free in hashslice in mrbgems/mruby-hash-ext/src/hash-ext.c...

PT-2020-19257

Name of the Vulnerable Software and Affected Versions mruby version 2.1.0 Description A use-after-free issue exists in the hash slice function located in mrbgems/mruby-hash-ext/src/hash-ext.c. Recommendations For mruby version 2.1.0, at the moment, there is no information about a newer version th...

PT-2020-19255

Name of the Vulnerable Software and Affected Versions mruby version 2.1.0 Description A use-after-free issue exists in the hash values at function located in mrbgems/mruby-hash-ext/src/hash-ext.c. Recommendations For mruby version 2.1.0, at the moment, there is no information about a newer versio...

PT-2020-7219

Name of the Vulnerable Software and Affected Versions Condor versions 7.6.x through 7.6.9 Condor versions 7.8.x through 7.8.3 Description The my popenv impl and my spawnv functions in src/condor utils/my popen.cpp and the systemCommand function in condor vm-gahp/vmgahp common.cpp do not properly...