Multiple vulnerabilities in a-blog cms

Overview a-blog cms provided by appleple inc. contains multiple vulnerabilities listed below. Reflected cross-site scripting CWE-79 - CVE-2019-6033 Script injection due to a flaw in processing cookie CWE-74 - CVE-2019-6034 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this...

JVN#10377257: Multiple vulnerabilities in a-blog cms

a-blog cms provided by appleple inc. contains multiple vulnerabilities listed below. Reflected cross-site scripting CWE-79 - CVE-2019-6033 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N| Base Score: 4.3...

Multiple vulnerabilities in Cybozu Office

Overview Cybozu Office provided by Cybozu, Inc. contains multiple vulnerabilities listed below. Directory traversal in the "Customapp" function CWE-22 - CVE-2019-6022 Browse restriction bypass in the application "Address" CWE-284 - CVE-2019-6023 Two vulnerabilities were reported by the following...

PT-2019-13483 · Unknown · En100 Ethernet Module Iec 61850 Variant +4

Name of the Vulnerable Software and Affected Versions: EN100 Ethernet module DNP3 variant All versions EN100 Ethernet module IEC 61850 variant All versions V4.37 EN100 Ethernet module IEC104 variant All versions EN100 Ethernet module Modbus TCP variant All versions EN100 Ethernet module PROFINET ...

SUSE-SU-2019:3270-1 Security update for caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, crowbar-ui, etcd, flannel, galera-3, mariadb, mariadb-connector-c, openstack-dashboard-theme-SUSE, openstack-heat-templates, openstack-neutron, openstack-nova, openstack-quickstart, patterns-cloud, python-oslo.messaging, python-oslo.utils, python-pysaml2

This update for caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, crowbar-ui, etcd, flannel, galera-3, mariadb, mariadb-connector-c, openstack-dashboard-theme-SUSE, openstack-heat-templates, openstack-neutron, openstack-nova, openstack-quickstart, patterns-cloud,...

Input validation

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions...

CVE-2019-13663

IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...

OPENSUSE-SU-2019:2521-1 Security update for go1.12

This update for go1.12 fixes the following issues: Security issues fixed: - CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling bsc1152082. - CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys bsc1154402. Non-security issue fixed:...

PT-2019-4472 · Linux +6 · Linux Kernel +6

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.3.12 Description: The issue is related to a use-after-free bug in the drivers/input/ff-memless.c driver of the Linux kernel. This bug can be triggered by a malicious USB device, potentially leading to a denial...

PT-2019-13937 · Yandex +1 · Clickhouse +1

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 19.14.3 Description: The issue allows an attacker with write access to ZooKeeper and the ability to run a custom server on the network where ClickHouse runs to create a malicious server acting as a ClickHouse...

PT-2019-5886 · Oniguruma +5 · Oniguruma +5

Name of the Vulnerable Software and Affected Versions: Oniguruma versions 6.x through 6.9.4 rc2 Description: The issue is related to an integer overflow in the search in range function, which can lead to an out-of-bounds read. The offset of this read is under the control of an attacker, allowing...

PT-2019-6026 · Adobe · Media Encoder

Name of the Vulnerable Software and Affected Versions: Adobe Media Encoder versions 13.1 and earlier Description: The issue is related to an out-of-bounds read in memory, which could allow a remote attacker to gain unauthorized access to protected information. Successful exploitation may lead to...

MGASA-2019-0296 Updated e2fsprogs packages fix security vulnerability

Updated e2fsprogs packages fix security vulnerability: Lilith of Cisco Talos discovered a buffer overflow flaw in the quota code used by e2fsck from the ext2/ext3/ext4 file system utilities. Running e2fsck on a malformed file system can result in the execution of arbitrary code CVE-2019-5094. The...

NetCommons3 vulnerable to cross-site scripting

Overview NetCommons3 provided by The NetCommons Project contains a cross-site scripting vulnerability CWE-79. Toshiki Sasazaki of Waseda University reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrar...

PT-2019-5180

Name of the Vulnerable Software and Affected Versions ncurses versions prior to 6.1-20191012 Description The issue is related to a heap-based buffer over-read in the nc find entry function, located in the tinfo/comp hash.c file of the terminfo library in ncurses. This could potentially allow an...

Unbreakable Enterprise kernel security update

4.14.35-1902.6.6 - RDMA/restrack: Protect from reentry to resource return path Leon Romanovsky Orabug: 30388717 4.14.35-1902.6.5 - hvnetvsc: fix vf serial matching with pci slot info Haiyang Zhang Orabug: 30373111 - rds: Use correct conn when dropping connections due to cancel Hakon Bugge Orabug:...

OPENSUSE-SU-2019:2276-1 Security update for putty

This update for putty to version 0.73 fixes the following issues: Security issues fixed: - CVE-2019-17068: Fixed the insufficient handling of terminal escape sequences, that should delimit the pasted data in bracketed paste mode boo1152753. - CVE-2019-17069: Fixed a possible information leak caus...

PT-2019-4474 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.3.7 Description: The issue is related to a use-after-free bug in the drivers/usb/misc/adutux.c driver of the Linux kernel. This bug can be triggered by a malicious USB device, potentially leading to a denial o...

OPENSUSE-SU-2019:2227-1 Security update for python-numpy

This update for python-numpy fixes the following issues: Non-security issues fixed: - Updated to upstream version 1.16.1. bsc1149203 jscSLE-8532 This update was imported from the SUSE:SLE-15:Update update project...

PT-2019-5206 · Apache +1 · Netty +1

Name of the Vulnerable Software and Affected Versions: Netty versions prior to 4.1.42.Final Description: The issue is related to the incorrect handling of whitespace before the colon in HTTP headers, such as a "Transfer-Encoding : chunked" line. This can lead to HTTP request smuggling, allowing a...