540 matches found
PT-2020-2776 · Openjpeg +6 · Openjpeg +6
Name of the Vulnerable Software and Affected Versions: OpenJPEG versions 2.3.1 through 2020-01-28 Description: The issue is related to a heap-based buffer overflow in the opj t1 clbl decode processor function of the OpenJPEG library, specifically in the openjp2/t1.c file when qmfbid==1. This can ...
Microsoft ASP.NET Core Remote Code Execution Vulnerability
Microsoft ASP.NET Core is a framework of cross-platform open source framework from Microsoft. The framework is used to build cloud-based applications such as Web applications, Internet of Things applications, and mobile backends. A remote code execution vulnerability exists in Microsoft ASP.NET...
PT-2019-14730 · Jenkins · Jenkins Alauda Kubernetes Support Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Alauda Kubernetes Support Plugin versions 2.3.0 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing the...
Open-School SQL Injection Vulnerability
Open-School is a Web-based school management software. The software provides online fee collection, attendance and online library features. A SQL injection vulnerability exists in Open-School version 2.3 Community Edition and version 3.0, which stems from a lack of validation of externally entere...
WordPress Category Specific RSS feed Subscription plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Category Specific RSS feed Subscription is an RSS feed plugin used in it. A cross-site request forgery vulnerability exists in WordPres...
PT-2019-3866 · Fasterxml +3 · Jackson-Databind +3
Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x through 2.9.9 Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled for an externally exposed JSON endpoint and the service has JDOM 1.x or...
UBUNTU-CVE-2019-0197
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server...
TheHive Elevation of Privilege Vulnerability
TheHive is a scalable open source security incident response platform. An elevation of privilege vulnerability exists in the User API in versions of TheHive prior to 2.13.4 and 3.x prior to 3.3.1, which can be exploited by an attacker with read-only or read/write access to escalate privileges to...
UBUNTU-CVE-2019-11356
The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name...
rubygems: Escape sequence injection vulnerability in verbose
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteractionverbose calls say without escaping, escape sequence injection is possible...
Apache Archiva Input Validation Error Vulnerability
Apache Archiva is a suite of software from the Apache USA Software Foundation for managing one or more remote repositories. The software provides features such as remote Repository agents, role-based secure access management, and usage reporting. An input validation error vulnerability exists in...
PT-2019-10045 · Rancher · Rancher
Name of the Vulnerable Software and Affected Versions: Rancher versions 2.0.0 through 2.1.5 Description: An issue allows project members with access to the default namespace to execute administrative privileged commands against the k8s cluster by mounting the netes-default service account in a po...
CVE-2019-9551
An issue was discovered in DOYO aka doyocms 2.3 through 2015-05-06. It has admin.php XSS...
ai.databand:dbnd-agent (>=0.42.1 <=0.80.6), ai.databand:dbnd-api-deequ (>=0.42.1 <=0.80.6) +1854 more potentially affected by CVE-2018-1000850 via com.squareup.retrofit2:retrofit (>=2.0.0 <=2.4.0)
com.squareup.retrofit2:retrofit MAVEN version =2.0.0, =0.42.1, =0.42.1, =0.40.2, =0.42.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =3.8.3.1, =3.8.2.1, =1.0.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2018-1000850 Source advisory: OSV:GHSA-8P8G-F9VG-R7XR...
CloudBees Jenkins Information Disclosure Vulnerability (CNVD-2019-04442)
CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...
YunoHost Cross-Site Scripting Vulnerability
YunoHost is a Linux-based server operating system. A cross-site scripting vulnerability exists in the profile edit page of the user panel in YunoHost versions 2.7.2 through 2.7.14. A remote attacker can exploit this vulnerability by injecting JavaScript code to manipulate user sessions...
DEBIAN-CVE-2018-19626
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination...
tmux denial of service vulnerability
tmux is an open source terminal multiplexer. A security vulnerability exists in the 'formatcbpanetabs' function in the format.c file in tmux versions 2.7 through 2.8. An attacker can exploit this vulnerability to cause a denial of service null pointer backreference and application crash...
wpa_supplicant: Unauthenticated EAPOL-Key decryption in wpa_supplicant
An issue was discovered in rsnsupp/wpa.c in wpasupplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive...