PT-2020-5157 · Openbsd +1 · Opensmtpd +1

Name of the Vulnerable Software and Affected Versions: OpenSMTPD versions prior to 6.6.4 Description: The issue is related to an out-of-bounds read in the mta io function in mta session.c for multi-line replies, which can allow remote code execution. Although this affects the client side of...

Kubernetes: Github test clientID and clientSecret leaked

Report Submission Form Summary: A github clientID and clientSecret for an oauth app are being leaked on github Description While looking for anything that is interesting on github I a clientID and clientSecret for a github oauth app hardcoded. While they have been removed a long time ago, they ar...

WordPress nex-forms-express-wp-form-builde plugin SQL injection vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. nex-forms-express-wp-form-builder is a form builder plugin used in it. A SQL injection vulnerability exists in the...

Squid URI processor input validation error vulnerability

Squid is a suite of proxy server and web caching server software. The software provides caching the World Wide Web , filtering traffic , proxy Internet access , etc. URI processor is one of the URI Uniform Resource Identifier processor . An input validation error vulnerability exists in the URI...

GHSA-58P8-9G59-Q2HR Potential DOS attack due to unrestricted attachment count in messages

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and...

CVE-2019-4512

IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554...

What you — and your company — should know about cyber insurance

By Jon Munshaw and Joe Marshall. It’s no longer a question of “if” any given company or organization is going to be hit with a cyber attack — it’s when. And when that attack comes, who is willing to take on that risk? For some groups, it may be that they feel they are fully prepared to take on th...

PT-2019-2900 · Icedtea +4 · Icedtea-Web +4

Name of the Vulnerable Software and Affected Versions: IcedTea-Web versions 1.7.2 and 1.8.2 Description: The issue is related to the improper sanitization of paths from jar/ elements in JNLP files. This could allow an attacker to trick a victim into running a specially crafted application,...

Unspecified Vulnerability in Teclib GLPI

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A security vulnerability exists in Teclib GLPI version 9.3.1. An attacker...

Dell pre-installed SupportAssist components DLL hijacking vulnerability, worldwide more than 1 billion devices face a cyber-attack risk-vulnerability warning-the black bar safety net

SupportAssist is a powerful support application helps to ensure that the user of the system is always running optimally, take the initiative to find the problem and allows you to run the diagnostic program and the driver update scan. Recently, however, researchers have found that this tool softwa...

CVE-2019-4219

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 159228...

Cisco NX-OS Software Data Forgery Issue Vulnerability (CNVD-2019-14715)

Cisco NX-OS Software is a set of data center-grade operating system software for switches from the U.S. company Cisco Cisco. A data forgery vulnerability exists in the Image Signature Verification feature in Cisco NX-OS Software. The vulnerability arises from a network system or product that does...

File Upload Vulnerability in Super CMS Backend

Super CMS by the SEO Research Center in order to solve the problem of website optimization and research and development of a set of products, using an object-oriented approach to independent research and development of the MVC framework development, is an open source content management system...

CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello

A flaw was found in the way NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. A man-in-the-middle attacker could use this flaw in a passive replay attack...

apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*

It was discovered that when Apache CXF is configured to use the system property com.sun.net.ssl.internal.www.protocol ,it uses reflection to make the HostnameVerifier work with old com.sun.net.ssl.HostnameVerifier interface. Although the CXF implementation throws an exception, which is caught in...

Bcxss Integer Overflow Vulnerability

Bcxss is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in the smart contract implementation of Bcxss. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

CVE-2007-5199

A single byte overflow in catalogue.c in X.Org libXfont 1.3.1 allows remote attackers to have unspecified impact...

“Dishwasher”was traced to a directory traversal vulnerability, an IOT security is getting worse and worse-vulnerability warning-the black bar safety net

Although the IOT the number of devices increases exponentially, but these smart devices security level has not increased, the user still faces a high cyber-attack risk. Miele Miele was founded in Germany one hundred years of home appliance brand, recently one model for PG8528 networked medical...

tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener

The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker...