Security update for libtomcrypt (moderate)

openSUSE Security Update: Security update for libtomcrypt Announcement ID: openSUSE-SU-2019:2454-1 Rating: moderate References: 1153433 Cross-References: CVE-2019-17362 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for...

rubygems: Escape sequence injection vulnerability in verbose

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteractionverbose calls say without escaping, escape sequence injection is possible...

CVE-2019-4400

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 162261...

CVE-2017-10784

It was found that WEBrick did not sanitize all its log messages. If logs were printed in a terminal, an attacker could interact with the terminal via the use of escape sequences...

GHSA-MVQP-Q37C-WF9J io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection')

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' Versions of Ratpack 0.9.1 through and including 1.7.4 are vulnerable to HTTP Response Splitting, if untrusted and unsanitized data is used to populate the headers of an HTTP response. An attacker can...

CVE-2019-10715

There is Stored XSS in Verodin Director 3.5.3.0 and earlier via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages...

Cross site scripting

There is Stored XSS in Verodin Director 3.5.3.0 and earlier via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages...

CVE-2019-10715

There is Stored XSS in Verodin Director 3.5.3.0 and earlier via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages...

CVE-2019-10715: Improper Neutralization of Input During Web Page Generation

There is Stored XSS in Verodin Director 3.5.3.0 and earlier via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages...

CVE-2017-0899

A vulnerability was found where rubygems did not properly sanitize gems' specification text. A specially crafted gem could interact with the terminal via the use of escape sequences...

CVE-2008-4687

manageprojpage.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by createfunction within the multisort function in core/utilityapi.php...

Multiple Cisco Unified Communications Products Cross Site Request Forgery Vulnerability

Description Multiple Cisco Unified Communications Products are prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the...

CVE-2019-4423: Improper Limitation of a Pathname to a Restricted Directory

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 162769...

CVE-2018-1847

IBM Financial Transaction Manager FTM for Multi-Platform MP v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.1.1.0 through 2.1.1.4, and v3.0.0.0 through 3.0.0.8 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request...

CVE-2018-1847: Improper Limitation of a Pathname to a Restricted Directory

IBM Financial Transaction Manager FTM for Multi-Platform MP v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.1.1.0 through 2.1.1.4, and v3.0.0.0 through 3.0.0.8 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request...

FreeBSD : bro -- invalid memory access or heap buffer over-read (55571619-454e-4769-b1e5-28354659e152)

Jon Siwek of Corelight reports : This is a security patch release to address a potential Denial of Service vulnerability : - The NTLM analyzer did not properly handle AV Pair sequences that were either empty or unterminated, resulting in invalid memory access or heap buffer over-read. The NTLM...

CVE-2019-4268

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 160201...

CVE-2019-4268: Improper Limitation of a Pathname to a Restricted Directory

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 160201...

PT-2019-17007 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 7.0 through 9.0 Description: The issue allows a remote attacker to traverse directories on the system by sending a specially-crafted URL containing dot dot sequences /../ to view arbitrary files on th...

PT-2021-3327 · Gnu +9 · Glibc +9

Name of the Vulnerable Software and Affected Versions: glibc versions through 2.32 Description: The issue is related to a buffer over-read in the iconv feature of the GNU C Library when processing invalid multi-byte input sequences in the EUC-KR encoding. This could potentially allow a remote...