GHSA-R5FX-8R73-V86C AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes

Versions of angular prior to 1.5.0-beta.1 are vulnerable to Cross-Site Scripting. The package fails to sanitize xlink:href attributes, which may allow attackers to execute arbitrary JavaScript in a victim's browser if the value is user-controlled. Recommendation Upgrade to version 1.5.0-beta.1 or...

PT-2020-15342 · Jenkins · Jenkins Applatix Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Applatix Plugin versions 1.1 and earlier Description: The issue allows unauthorized access to unencrypted passwords stored in job config.xml files on the Jenkins master. Users with Extended Read permission or access to the master file...

PT-2020-19876 · Dovecot +1 · Dovecot +1

Name of the Vulnerable Software and Affected Versions: Dovecot versions 2.3.9 through 2.3.9.2 Description: The issue arises from the mishandling of snippet generation by the IMAP and LMTP components when a large number of characters must be read to compute the snippet and a trailing character...

PT-2020-20289 · Salesagility · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.11.12 Description: The issue allows for PHP Object Injection in the EmailsController Action GetFromFields. Recommendations: For SuiteCRM versions prior to 7.11.12, update to version 7.11.12 or later to resolve the...

Persistent XSS vulnerability in filename of attached file in PrivateBin

In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting XSS vulnerability. The vulnerability has been fixed in PrivateBin...

Cryptographic Issues

Overview bcrypt is an A library to help you hash passwords. Affected versions of this package are vulnerable to Cryptographic Issues. When hashing a password containing an ASCII NUL character, that character acts as the string terminator. Any following characters are ignored. Remediation Upgrade...

PT-2020-5164

Name of the Vulnerable Software and Affected Versions PySAML2 versions prior to 5.0.0 Description The issue is related to incorrect verification of cryptographic signatures in SAML2 documents, allowing a remote attacker to bypass signature checks and access protected information. This is due to t...

PT-2019-9574 · Crushftp · Crushftp

Name of the Vulnerable Software and Affected Versions: CrushFTP versions prior to 8.3.1 Description: The issue allows for credentials theft via URL redirection. Recommendations: For CrushFTP versions prior to 8.3.1, update to version 8.3.1 or later to resolve the issue...

Security Bulletin: Clickjacking vulnerability in IBM Operations Analytics - Log Analysis (CVE-2019-4215)

Summary There is a clickjacking vulnerability in IBM Operations Analytics - Log Analysis Vulnerability Details CVEID: CVE-2019-4215 DESCRIPTION: CVSS Base score: 6.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159186 for the current score. CVSS Vector:...

Elastic Stack 6.8.6 and 7.5.1 security update

Kibana XSS ESA-2019-17 Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting XSS flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that...

Arbitrary File Write

Overview Versions of iobroker.controller prior to 2.0.25 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended /adapter/ folder, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to...

PT-2020-5524 · Imagemagick +5 · Imagemagick +5

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 7.0.9-0 Description: A flaw was found in ImageMagick in MagickCore/quantum-export.c, related to an integer overflow. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined...

GHSA-89MQ-4X47-5V83 angular Prototype Pollution vulnerability

Versions of angular prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function merge does not restrict the modification of an Object's prototype in the , which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation Upgrade...

Sandbox Breakout / Prototype Pollution

Overview Versions of notevil prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype. Evaluating the payload tryab;catchee.constructor.constructor'return...

PT-2019-15078 · Sugarcrm · Sugarcrm

Name of the Vulnerable Software and Affected Versions: SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description: The issue allows PHP object injection in the Administration module by an Admin user. Recommendations: For SugarCRM versions prior to 8.0.4, update to version...

DEBIAN-CVE-2019-0231

Handling of the closenotify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This...

PT-2019-17109 · Ibm · Ibm Jazz Reporting Service

Name of the Vulnerable Software and Affected Versions: IBM Jazz Reporting Service JRS versions 6.0 through 6.0.6.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

Insecure Randomness

Overview org.apereo.cas:cas-server-support-shell is a package for the CAS command-line shell provides the ability to query the CAS server for help on available settings/modules and various other utility functions. Affected versions of this package are vulnerable to Insecure Randomness. A insecure...

Improper Key Verification in openpgp

Versions of openpgp prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed or unhashed. Unhashed subpackets are not cryptographically protected and cannot be trusted. The openpgp package does not verify...

PT-2019-7689 · WordPress · Crayon Syntax Highlighter

Name of the Vulnerable Software and Affected Versions: crayon-syntax-highlighter plugin versions prior to 2.8.4 Description: The issue concerns multiple XSS problems that can be triggered via AJAX requests. Recommendations: For versions prior to 2.8.4, update to version 2.8.4 or later to resolve...