Debian: Security Advisory (DSA-4617-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2020-6508

Name of the Vulnerable Software and Affected Versions PlaySMS versions prior to 1.4.3 Description The issue is related to insufficient sanitization of special elements in a string, which can be exploited by a remote attacker to execute arbitrary code. This is a server-side template injection...

Debian DSA-4617-1 : qtbase-opensource-src - security update

Two security issues were found in the Qt library, which could result in plugins and libraries being loaded from the current working directory, resulting in potential code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

DSA-4617-1 qtbase-opensource-src - security update

Bulletin has no description...

Debian DLA-2092-1 : qtbase-opensource-src security update

In Qt5's plugin loader code as found in qtbase-opensource-src, it was possible to side-load plugins from 'the' local folder in addition to a system-widely defined library path. For Debian 8 'Jessie', this problem has been fixed in version 5.3.2+dfsg-4+deb8u4. We recommend that you upgrade your...

[SECURITY] [DLA 2092-1] qtbase-opensource-src security update

Package : qtbase-opensource-src Version : 5.3.2+dfsg-4+deb8u4 CVE ID : CVE-2020-0569 In Qt5s plugin loader code as found in qtbase-opensource-src, it was possible to side-load plugins from "the" local folder in addition to a system-widely defined library path. For Debian 8 "Jessie", this problem...

Debian: Security Advisory (DLA-2092-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-5217

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

Code injection

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

CVE-2020-5217 Directive injection when using dynamic overrides with user input in RubyGems secure_headers

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

PT-2020-18313

Name of the Vulnerable Software and Affected Versions Secure Headers versions prior to 3.8.0 Secure Headers versions prior to 5.1.0 Secure Headers versions prior to 6.2.0 Description A directive injection vulnerability is present in Secure Headers. If user-supplied input was passed into...

CVE-2020-5217: Improper Neutralization of Directives in Dynamically Evaluated Code

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...

CVE-2020-6840

In mruby 2.1.0, there is a use-after-free in hashslice in mrbgems/mruby-hash-ext/src/hash-ext.c...

PT-2020-19257

Name of the Vulnerable Software and Affected Versions mruby version 2.1.0 Description A use-after-free issue exists in the hash slice function located in mrbgems/mruby-hash-ext/src/hash-ext.c. Recommendations For mruby version 2.1.0, at the moment, there is no information about a newer version th...

PT-2020-19255

Name of the Vulnerable Software and Affected Versions mruby version 2.1.0 Description A use-after-free issue exists in the hash values at function located in mrbgems/mruby-hash-ext/src/hash-ext.c. Recommendations For mruby version 2.1.0, at the moment, there is no information about a newer versio...

PT-2020-7219

Name of the Vulnerable Software and Affected Versions Condor versions 7.6.x through 7.6.9 Condor versions 7.8.x through 7.8.3 Description The my popenv impl and my spawnv functions in src/condor utils/my popen.cpp and the systemCommand function in condor vm-gahp/vmgahp common.cpp do not properly...

PT-2020-10382

Name of the Vulnerable Software and Affected Versions Pandora FMS versions prior to 7.0 NG 742 Description The issue allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip src parameter in an "index.php?operation/netflow/nf live view" request. This i...

Unrestricted file upload

Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI...

CVE-2020-5514: Unrestricted Upload of File with Dangerous Type

Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI...

PT-2020-18491

Name of the Vulnerable Software and Affected Versions Gila CMS version 1.11.8 Description The issue allows for the unrestricted upload of a file with a dangerous type via .phar or .phtml to the /lzld/thumb?src= API endpoint. This could potentially lead to security risks. Recommendations For Gila...