CVE-2020-13659 affecting package qemu-kvm 4.2.0-48

CVE-2020-13659 affecting package qemu-kvm 4.2.0-48. A patched version of the package is available...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server, which is shipped with, or a required product for, IBM Tivoli Network Manager (CVE-2020-1927, CVE-2020-1934)

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Network Manager version 3.9 & 4.1.1; IBM WebSphere Application Server is a required product for IBM Tivoli Network Manager version 4.2. Information about security vulnerabilities affecting IBM HTTP Server, a component of IBM...

Security Bulletin: TLS padding vulnerability affects Sterling Connect:Direct for UNIX (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects Sterling Connect:Direct for UNIX. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

QEMU Code Issue Vulnerability (CNVD-2020-51532)

QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A code issue vulnerability exists in QEMU version 4.2.0. The vulnerability arises from an improper design or implementation...

PT-2020-14436

Name of the Vulnerable Software and Affected Versions QEMU version 4.2.0 Description A MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. Recommendations For QEMU version 4.2.0, at the moment, there is no information about a newer version that...

GHSA-5X3V-2GXR-59M2 Directory traversal in Apache RocketMQ

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversa...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang...

Directory traversal

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversa...

QEMU: Multiple vulnerabilities

Background QEMU is a generic and open source machine emulator and virtualizer. Description Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no...

PT-2021-7351

Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 4.2.0 Description The issue is related to an out-of-bounds heap buffer access in the ARM Generic Interrupt Controller emulator of QEMU. This occurs because the interrupt ID written to the controller memory are...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is shipped with, or a required product for, IBM Tivoli Network Manager IP Edition (CVE-2019-4268).

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Network Manager IP Edition versions 3.9 and 4.1.1; IBM WebSphere Application Server is a required product for IBM Tivoli Network Manager IP Edition version 4.2. Information about a security vulnerability affecting IBM WebSphere...

nopCommerce Elevation of Privilege Vulnerability

nopCommerce is an open source e-commerce shopping cart software. nopCommerce 4.2.0 suffers from an elevation of privilege vulnerability that can be exploited by an attacker with the help of a specially crafted Facebook Auth plugin...

PowerDNS Authoritative Server 4.x < 4.2.0 DoS Vulnerability

PowerDNS Authoritative Server is prone to a denial of service DoS vulnerability when encountering a serial between 2^31 and 2^32-1 while trying to notify a slave. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

Sensio Labs Symfony Information Disclosure Vulnerability

Sensio Labs Symfony is a free French Sensio Labs , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools , can be used to quickly create complex WEB program . An information disclosure vulnerability exists in Sensio...

UBUNTU-CVE-2019-18889

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache...

WiKID Systems 2FA Enterprise Server Cross-Site Scripting Vulnerability

WiKID Systems 2FA Enterprise Server is a two-factor authentication server from WiKID Systems, USA. A cross-site scripting vulnerability exists in WiKID 2FA Enterprise Server 4.2.0-b2047 and prior versions. The vulnerability stems from a WEB application lacking proper authentication of client data...

WiKID Systems 2FA Enterprise Server SQL Injection Vulnerability

WiKID Systems 2FA Enterprise Server is a two-factor authentication server from WiKID Systems, USA. A SQL injection vulnerability exists in the processPref.jsp file in WiKID 2FA Enterprise Server 4.2.0-b2053 and prior versions. The vulnerability stems from a database-based application that lacks...

CVE-2019-17118

A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as 1 create or delete admin users; 2 create or delete groups; or 3 create, delete, enable, or disable normal users or devices...

CVE-2019-17114

A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scriptin...

CVE-2018-5732

Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server or an entity masquerading as a server to cause a buffer overflow and resulting crash in dhclient by sending a response containing a specially constructed options section. Affects ISC DHCP versions...