PT-2020-11010

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy versions 7.0.3 IBM UrbanCode Build version 6.1.5 Description The issue allows a local user to obtain sensitive information by unmasking certain secure values in documents. Recommendations For IBM UrbanCode Deploy version...

CVE-2020-1942

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was...

CVE-2020-1942

CVE-2020-1942 affects Apache NiFi versions 0.0.1 through 1.11.0. The root cause involves the flow fingerprint factory generating flow fingerprints that include sensitive property descriptor values, which can be exposed when a node joins a cluster and the cluster flow is not inheritable; the finge...

PT-2020-15179

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 0.0.1 through 1.11.0 Description The issue concerns the flow fingerprint factory in Apache NiFi, which generated flow fingerprints that included sensitive property descriptor values. When a node attempted to join a cluster...

Authorization Bypass

node is vulnerable to authorization bypass. Trailing OWS from header values are not stripped, potentially allowing a remote attacker to bypass access controls...

[SECURITY] Fedora 31 Update: nodejs-set-value-2.0.1-1.fc31

Create nested values and any intermediaries using dot notation a.b.c path s...

[SECURITY] Fedora 30 Update: nodejs-set-value-2.0.1-1.fc30

Create nested values and any intermediaries using dot notation a.b.c path s...

Fedora: Security Advisory for nodejs-set-value (FEDORA-2020-1f1c94907b)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2019-15606

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons...

UBUNTU-CVE-2019-15606

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons...

CVE-2019-15606

CVE-2019-15606 affects Node.js 10.x, 12.x and 13.x where trailing whitespace in HTTP header values can bypass header-based authorization. Public disclosures in Debian (DSA-4669-1) and Gentoo/Gentoo GLSA-202003-48 confirm multipleVulns including 15606; Elastic KB notes DoS/HTTP‑smuggling implicati...

Command injection

Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could let a remote malicious user cause a Denial of Service...

CVE-2012-6297: Cross-Site Request Forgery (CSRF)

Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could let a remote malicious user cause a Denial of Service...

IBM Cloud Automation Manager Information Disclosure Vulnerability

IBM Cloud Automation Manager is a multi-cloud self-service management platform from IBM USA. The platform supports the deployment of cloud infrastructure in multiple clouds. An information disclosure vulnerability exists in IBM Cloud Automation Manager, which can be exploited by an attacker to...

February 2020 Security Releases

February 2020 Security Releases Update 6-February-2020 Security releases available Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605 Affected Node.js versions can be...

Cross-site Scripting (XSS)

fec-style is vulnerable to cross-site scripting XSS attacks. The attack is possible due to improper sanitization of query string in the URL which determines all the characters are safe for filter values, allowing an attacker to inject malicious code...

CVE-2020-2099: Use of Insufficiently Random Values

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonati...

DEBIAN-CVE-2013-6451

Cross-site scripting XSS vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values...

Cross site scripting

Cross-site scripting XSS vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values...

CVE-2013-6451

Cross-site scripting XSS vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values...