602 matches found
python: CRLF injection via the path part of the url passed to urlopen()
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the path component of a URL that...
CVE-2019-0283
SAP NetWeaver Process Integration Adapter Engine, fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be accepted by the PI Ax...
UBUNTU-CVE-2019-9740
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the query string after a ? charact...
UBUNTU-CVE-2018-20406
Modules/pickle.c in Python before 3.7.1 has an integer overflow via a large LONGBINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of...
GHSA-GXPJ-CX7G-858C Regular Expression Denial of Service in debug
Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue. This was later re-introduced in version v3.2.0, and...
rack-protection: Timing attack in authenticity_token.rb
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...
ALPINE-CVE-2017-7228
An issue known as XSA-212 was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arra...
SUSE-SU-2015:1015-1 Recommended update for dnsmasq
This update provides dnsmasq version 2.71, which brings several fixes and enhancements. For a comprehensive list of changes, please refer to the package change log. FATE317370...
MGASA-2014-0209 Updated owncloud packages fix several security vulnerabilities
Updated owncloud packages fix security vulnerabilities: Owncloud versions 5.0.16 and 6.0.3 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information...
thunderbird security update
24.3.0-2.0.1.el65 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Make sure build with nspr-devel = 4.10.0 24.3.0-2 - Update to 24.3.0 ESR Build 2 24.3.0-1 - Update to 24.3.0 24.2.0-2 - Fixed requested nspr/nss versions...
DSA-2220-1 request-tracker3.8 - several
Bulletin has no description...
DSA-668-1 postgresql - privilege escalation
Bulletin has no description...
DSA-617-1 libtiff - insufficient input validation
Bulletin has no description...
DSA-562-2 mysql - several vulnerabilities
Bulletin has no description...
MyDms 1.4 - SQL Injection Directory Traversal
MyDms 1.4 - SQL Injection Directory Traversal source: https://www.securityfocus.com/bid/10996/info MyDMS is reportedly susceptible to both a directory traversal vulnerability and an SQL injection vulnerability. The SQL injection vulnerability is present because a script improperly sanitizes...
[SECURITY] [DSA 519-1] New CVS packages fix several potential security problems
-------------------------------------------------------------------------- Debian Security Advisory DSA 519-1 [email protected] http://www.debian.org/security/ Martin Schulze June 15th, 2004 http://www.debian.org/security/faq -...
[SECURITY] [DSA 398-1] New conquest packages fix local conquest exploit
-------------------------------------------------------------------------- Debian Security Advisory DSA 398-1 [email protected] http://www.debian.org/security/ Martin Schulze November 10th, 2003 http://www.debian.org/security/faq -...
[SECURITY] [DSA-345-1] New xbl packages fix buffer overflow
-------------------------------------------------------------------------- Debian Security Advisory DSA 345-1 [email protected] http://www.debian.org/security/ Matt Zimmerman July 8th, 2003 http://www.debian.org/security/faq -...