npm Ini Resource Management Error Vulnerability

npm Ini is a Javascript-based code library for parsing and serializing Ini format files from the US-based npm Inc. A resource management error vulnerability exists in npm Ini 1.3.6, which allows an attacker to exploit the vulnerability by submitting a malicious INI file to an application that wil...

ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse

Overview The ini npm package before version 1.3.6 has a Prototype Pollution vulnerability. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. Patch...

Prototype Pollution

Overview ini before version 1.3.6 has a Prototype Pollution vulnerability. Impact If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. Patches This h...

HashiCorp Vault Information Disclosure Vulnerability

HashiCorp Vault is a private key access management tool from HashiCorp USA. A security vulnerability exists in HashiCorp Vault and Vault Enterprise versions prior to 1.3.6 and prior to 1.4.2, which originates when the program inserts sensitive information into a log file including usernames and...

CVE-2020-13223

HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2...

PT-2020-13380 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.3.6 HashiCorp Vault and Vault Enterprise versions prior to 1.4.2 Description: The issue concerns the logging of proxy environment variables that may contain sensitive credentials. This...

Security Bulletin: A vulnerability in Python affects IBM Operations Analytics Predictive Insights (CVE-2019-10160)

Summary Python is used by IBM Operations Analytics Predictive Insights. IBM Operations Analytics Predictive Insights has addressed the applicable CVE. Note that the usage of Python within IBM Operations Analytics Predictive Insights is limited to the REST Mediation utility. If you do not use that...

DEBIAN-CVE-2019-19271

An issue was discovered in tlsverifycrl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries installed by a system administrator, can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to...

UBUNTU-CVE-2019-19271

An issue was discovered in tlsverifycrl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries installed by a system administrator, can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to...

DEBIAN-CVE-2019-13615

libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement...

CVE-2019-7570

A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI...

Fedora 29 : php-pear-CAS (2018-6d62140b89)

Version 1.3.6 Security Fixes: - Fix XSS in proxy mode 271 Joachim Fritschi Bug Fixes: - Fix bad condition 252 Brice Vercoustre - Hash ticket strings to generate valid-length session-ids 224, 244, 248 Adam Franco - Fix 'phpCAS' class capitalization in code 273, 277 phy25 Improvement: - Remove...

Fedora 28 : php-pear-CAS (2018-0bc91454ce)

Version 1.3.6 Security Fixes: - Fix XSS in proxy mode 271 Joachim Fritschi Bug Fixes: - Fix bad condition 252 Brice Vercoustre - Hash ticket strings to generate valid-length session-ids 224, 244, 248 Adam Franco - Fix 'phpCAS' class capitalization in code 273, 277 phy25 Improvement: - Remove...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Operations Analytics Predictive Insights (CVE-2018-1621)

Summary Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin:...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Operations Analytics Predictive Insights (CVE-2017-1743)

Summary WebSphere Application Server is shipped as a component of IBM Operations Analytics Predictive Insights. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin...

ALPINE-CVE-2018-10393

barknoisehybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read mapping0forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service heap-based buffer overflow or over-read or possibly have...

Xiph.Org libvorbis 'bark_noise_hybridmp' function stack buffer out-of-bounds read vulnerability

Xiph.Org libvorbis is an open source library of audio encoding and decoding functions for medium to high quality audio at fixed or variable bit rates. A stack buffer out-of-bounds read vulnerability exists in the 'barknoisehybridmp' function of the psy.c file in Xiph.Org libvorbis version 1.3.6. ...

Fedora 27 : roundcubemail (2018-57fbdb1cb5)

Upstream announcement : Version 1.3.6 This is a security update to the stable version 1.3. It primarily fixes a recently discovered IMAP command injection vulnerability caused by insufficient input validation within the archive plugin. Details about the vulnerability are published under...

SQL Injection(CVE-2017-12650) and CSRF(CVE-2017-12651) Security Vulnerability in Loginizer

As part of a vulnerability research project for our WordPress Security Scanner at WPcans.com, we have been auditing popular WordPress plugins looking for security issues. While auditing the WordPress plugin Loginizer, we discovered a SQL Injection vulnerability and a Cross-Site Request Forgery...