CVE-2020-15308: Improper Neutralization of Special Elements used in an SQL Command

Support Incident Tracker aka SiT! or SiTracker 3.67 p2 allows post-authentication SQL injection via the siteedit.php typeid or site parameter, the searchincidentsadvanced.php searchtitle parameter, or the reportqbe.php criteriafield parameter...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists as a possible kernel memory leak was found in the Linux kernel Simple Internet Transition SIT INET6 implementation...

Vulnerability of the sit_init_net() function (net/ipv6/sit.c) in the Linux kernel, which allows a hacker to cause a service failure

The vulnerability of the sitinitnet function from net/ipv6/sit.c in the Linux kernel is related to the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow a remote attacker to cause service failures...

CVE-2019-20221

In Support Incident Tracker SiT! 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, executed on the about.php page...

CVE-2019-20222

In Support Incident Tracker SiT! 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS...

Cross site scripting

In Support Incident Tracker SiT! 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS...

CVE-2019-20220

The CVE-2019-20220 entry concerns Support Incident Tracker (SiT!) version 3.67. A cross-site scripting (XSS) flaw is located in the search_id parameter of the search_incidents_advanced.php page, arising from insufficient validation of user-supplied data. Documented impact is client-side code exec...

CVE-2019-20221

CVE-2019-20221 affects Support Incident Tracker (SiT!) version 3.67. The vulnerability is a Cross-Site Scripting (XSS) in the “Load Plugins” input on the config.php page, with the payload potentially executed on pages such as about.php. Multiple sources corroborate the issue across CVE records an...

CVE-2019-20222

The CVE-2019-20222 entry affects Support Incident Tracker (SiT!) version 3.67, where the Short Application Name and Application Name fields in the config.php page are vulnerable to cross-site scripting (XSS). Multiple connected sources (NVD entry and Red Hat security advisory) confirm the issue a...

CVE-2019-20222

In Support Incident Tracker SiT! 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS...

CVE-2019-20223

CVE-2019-20223 is an XSS flaw in Support Incident Tracker (SiT!) 3.67 where the id parameter is reflected across endpoints that use it. Red Hat’s advisory reiterates the XSS in SiT! 3.67, tied to CVE-2012-2235, with no details on patches within the provided documents. The OpenVAS entry references...

CVE-2019-20223: Improper Neutralization of Input During Web Page Generation

In Support Incident Tracker SiT! 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CVE-2012-2235...

CVE-2019-20221: Improper Neutralization of Input During Web Page Generation

In Support Incident Tracker SiT! 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, executed on the about.php page...

CVE-2019-20220: Improper Neutralization of Input During Web Page Generation

In Support Incident Tracker SiT! 3.67, the searchid parameter in the searchincidentsadvanced.php page is affected by XSS...

CVE-2019-20222: Improper Neutralization of Input During Web Page Generation

In Support Incident Tracker SiT! 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0056)

The remote OracleVM system is missing necessary patches to address critical security updates : - ocfs2: protect extent tree in ocfs2prepareinodeforwrite Shuning Zhang Orabug: 30036349 - ocfs2: direct-IO: protect getblocks Junxiao Bi Orabug: 30036349 - SUNRPC: Remove xprtconnectstatus Trond...

Unbreakable Enterprise kernel security update

4.1.12-124.33.4 - ocfs2: protect extent tree in ocfs2prepareinodeforwrite Shuning Zhang Orabug: 30036349 - ocfs2: direct-IO: protect getblocks Junxiao Bi Orabug: 30036349 - SUNRPC: Remove xprtconnectstatus Trond Myklebust Orabug: 30165838 - SUNRPC: Handle ENETDOWN errors Trond Myklebust Orabug:...

kernel: Memory leak in sit_init_net() in net/ipv6/sit.c

A flaw was found in the way the sitinitnet function in the Linux kernel handled resource cleanup on errors. This flaw allows an attacker to use the error conditions to crash the system...

Vulnerable Twitter API Leaves Tens of Thousands of iOS Apps Open to Attacks

Researchers are warning that an old Twitter API still used by popular iOS mobile apps that could be abused as part of a man-in-the-middle attack. It could be used to hijack Twitter accounts and compromise other third-party apps that are linked to the same “login with Twitter” feature. According t...

DEBIAN-CVE-2019-16994

In the Linux kernel before 5.0, a memory leak exists in sitinitnet in net/ipv6/sit.c when registernetdev fails to register sitn-fbtunneldev, which may cause denial of service, aka CID-07f12b26e21a...