kubernetes: Bearer tokens written to logs at high verbosity levels (>= 7)

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components such as kube-apiserver prior to v1.16.0, which make use of basic or bearer token authentication, and run ...

Apache SpamAssassin Operating System Command Injection Vulnerability

Apache SpamAssassin is an open source spam filter from the Apache USA Foundation. The product provides a filter for system administrators and supports categorizing email to block spam. A security vulnerability exists in Apache SpamAssassin versions prior to 3.4.3. An attacker could exploit the...

Zoho ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2020-04288)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...

ACRN Denial of Service Vulnerability

ACRN is an open source virtual machine monitor for the Internet of Things. A security vulnerability exists in versions prior to ACRN 2019w25.5-140,000p. An attacker can exploit the vulnerability to cause a denial of service assertion failure...

DEBIAN-CVE-2019-13740

Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page...

libyang buffer overflow vulnerability (CNVD-2019-45325)

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. A buffer overflow vulnerability exists in versions prior to libyang 1.0-r5. The vulnerability stems from a networked system or product that performs operations in memory withou...

Zabbix SIA Zabbix Encryption Issues Vulnerabilities

Zabbix SIA Zabbix is an open source monitoring system from the Latvian company Zabbix SIA. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. Zabbix SIA An encryption issue vulnerability exists in versions of Zabbix prior to 5.0, which stems fr...

Google Chrome Blink Code Issue Vulnerability

Google Chrome is a Web browser from Google, a U.S. company. Blink is a browser layout engine rendering engine jointly developed by Google and Norway's OperaSoftware. A code issue vulnerability exists in versions of Blink prior to m11 in Google Chrome. The vulnerability arises from a design or...

CVE-2019-19536

In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peakusb/pcanusbpro.c driver, aka CID-ead16e53c2f0...

Cloudera Manager Information Disclosure Vulnerability

Cloudera Manager is a suite of Hadoop data management software from Cloudera. The software supports creating clusters, authentication, data backup and recovery, and more. An information disclosure vulnerability exists in the Diagnostic Support Bundles in Cloudera Manager versions prior to 5.4.6...

ProFTPD 'tls_verify_crl' function authorization issue vulnerability

ProFTPD is a secure cloud printing solution from the ProFTPD team. The solution supports printing from laptops, desktops and mobile devices connected to printers. An authorization issue vulnerability exists in the 'tlsverifycrl' function in ProFTPD versions prior to 1.3.6. The vulnerability stems...

UBUNTU-CVE-2019-18449

An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions issue 2 of 2...

CVE-2019-17406

Nokia IMPACT 18A has path traversal that may lead to RCE if chained with CVE-2019-1743...

DEBIAN-CVE-2019-13682

Insufficient policy enforcement in external protocol handling in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

matomo cross-site scripting vulnerability (CNVD-2019-42239)

matomo is an open source web analytics application based on PHP and MySQL. A cross-site scripting vulnerability exists in matomo versions prior to 1.10.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerabilit...

Cisco Email Security Appliance AsyncOS Software Input Validation Error Vulnerability

Cisco Email Security Appliance ESA is an email security appliance from Cisco in the U.S. AsyncOS Software is the operating system that runs on it. An input validation error vulnerability exists in the MP3 detection engine of AsyncOS Software prior to version 13.0 in the Cisco ESA, which stems fro...

Linux kernel resource management error vulnerability (CNVD-2019-41719)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A resource management error vulnerability exists in the 'adisupdatescanmodeburst' function in the drivers/iio/imu/adisbuffer.c file in versions of Linux kernel prior t...

DEBIAN-CVE-2014-0021

Chrony before 1.29.1 has traffic amplification in cmdmon protocol...

DEBIAN-CVE-2019-18978

An issue was discovered in the rack-cors aka Rack CORS Middleware gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

CVE-2019-12720

AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvcsendmail.aspx MailAdd parameter SQL Injection. An Attacker can carry a SQL Injection payload to the server, allowing the attacker to read privileged data. This also affects the picturemanagemvc.aspx plantno parameter, the...