7289 matches found
Oracle Linux 7 : httpd (ELSA-2019-1898)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1898 advisory. 2.4.6-89.0.1 - replace index.html with Oracle's index page oracleindex.html 2.4.6-89.1 - Resolves: 1719722 - CVE-2018-1312 httpd: Weak Digest auth nonce...
CVE-2019-5396
CVE-2019-5396 affects HPE 3PAR Service Processor; prior to version 5.0.5.1, there is a remote authentication bypass vulnerability in the SP management interface. The issue allows an attacker with network access and no privileges to bypass authentication, potentially compromising confidentiality (...
nss and nspr security, bug fix, and enhancement update
nspr 4.21.0-2 - Rebuild 4.21.0-1 - Update to NSPR 4.21 nss 3.44.0-7 - Backport fixes from 3.44.1 3.44.0-6 - Add continuous RNG test required by FIPS - fipstest: use CKMTLS12MASTERKEYDERIVE instead of vendor specific mechanism 3.44.0-5 - Rebuild with the correct build target 3.44.0-4.1 - rebuild t...
SUSE-SU-2019:2035-1 Security update for polkit
This update for polkit fixes the following issues: Security issue fixed: - CVE-2019-6133: Fixed improper caching of auth decisions, which could bypass uid checking in the interactive backend bsc1121826...
Low: Red Hat Security Advisory: httpd security update
An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
CVE-2019-2737
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server : Pluggable Auth. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple...
CVE-2019-2737
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server : Pluggable Auth. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple...
Sensitive Data Exposure in parse-server
Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNTALREADYLINKED208 was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSIONMISSING206 for Insufficient auth. An attacker can guess ids and get...
CVE-2019-11650
A potential Man in the Middle attack MITM was found in NetIQ Advanced Authentication Framework versions prior to 6.0...
WordPress WP Like Button plugin <= 1.6.0 - Auth Bypass vulnerability
Auth Bypass vulnerability found by Benjamin Lim in WordPress WP Like Button plugin versions = 1.6.0. Solution 10 July 2019 - we were unable to find a patched version of the plugin...
CVE-2019-13345
The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...
ALPINE-CVE-2019-13345
The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...
DEBIAN-CVE-2019-13345
The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...
Design/Logic Flaw
The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...
CVE-2019-13345
The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...
CVE-2019-13345
The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...
CVE-2019-13345
The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...
CVE-2019-13345
The cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter...
WordPress: pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment
When a comment is submitted, it is filtered via wprelnofollowcallback, which adds the rel attribute to tags within the anchor: function wprelnofollowcallback $matches $text = $matches1; $atts = shortcodeparseatts $matches1 ; $rel = 'nofollow'; if ! empty $atts'href' if inarray strtolower wpparseu...
Design/Logic Flaw
An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie admin-auth is stored on a victim's computer results in the admin password being discoverable by a local attacker, and usable to gain administrative access to the victim's router...