DEBIAN-CVE-2019-17571

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1...

python-sqlalchemy: SQL Injection when the group_by parameter can be controlled

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...

python-sqlalchemy: SQL Injection when the group_by parameter can be controlled

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...

python-sqlalchemy: SQL Injection when the order_by parameter can be controlled

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the orderby parameter...

PYSEC-2019-123

SQLAlchemy before 1.3.0b3 allows SQL Injection via the orderby parameter. The fix commit 30307c4 was applied only to the main branch and was never backported to the 1.2.x release line; all 1.2.x versions remain vulnerable...

PYSEC-2019-53

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the orderby parameter...

PYSEC-2019-124

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...

MantisBT 1.1.2 - 1.2.17 XSS Vulnerability - Windows

MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

MantisBT 1.2.13 - 1.2.17 XSS Vulnerability - Linux

MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

MantisBT Configuration Report Page Cross-Site Scripting Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the 'set configuration' text box in the Configuration Report page in...

MantisBT 1.2.13 - 1.2.17 'adm_config_report.php' XSS Vulnerability

MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

MantisBT Admin SQL Injection Arbitrary File Read

Versions 1.2.13 through 1.2.16 are vulnerable to a SQL injection attack if an attacker can gain access to administrative credentials. This vuln was fixed in 1.2.17. Module Options msf use auxiliary/gather/mantisbt/adminsqli msf undefinedadminsqli show actions ...actions... msf undefinedadminsqli...

Wireshark Multiple Denial of Service Vulnerabilities June-11 (Mac OS X)

This host is installed with Wireshark and is prone to multiple denial of service vulnerabilities. OpenVAS Vulnerability Test $Id: secpodwiresharkmultdosvulnjun11macosx.nasl 5940 2017-04-12 09:02:05Z teissa $ Wireshark Multiple Denial of Service Vulnerabilities June-11 Mac OS X Authors: Rachana...

Wireshark Lucent/Ascend File Parser Denial of Service Vulnerability (Windows)

This host is installed with Wireshark and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbwiresharklucentascendfileparserdosvulnwin.nasl 7019 2017-08-29 11:51:27Z teissa $ Wireshark Lucent/Ascend File Parser Denial of Service Vulnerability Windows Authors: Shashi...

Mandriva Linux Security Advisory : wireshark (MDVSA-2011:105)

This advisory updates wireshark to the latest version 1.2.17, fixing several security issues : - Large/infinite loop in the DICOM dissector. Bug 5876 Versions affected: 1.2.0 to 1.2.16 and 1.4.0 to 1.4.6. - Huzaifa Sidhpurwala of the Red Hat Security Response Team discovered that a corrupted...