9405 matches found
SSON/Passthrough authentication not working with Edge browser
User tries to logon to MS Edge browser via SSON User is prompted to enter username and password instead of getting logged in automatically with SSON as expected...
CVE-2019-25031
Unbound before 1.9.5 allows configuration injection in createunboundadservers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. createunboundadservers.sh is a contributed script from the...
Design/Logic Flaw
DISPUTED Unbound before 1.9.5 allows configuration injection in createunboundadservers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. createunboundadservers.sh is a contributed script...
CVE-2019-25031
Unbound before 1.9.5 allows configuration injection in createunboundadservers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. createunboundadservers.sh is a contributed script from the...
Update mechanism Passwordstate compromised
Click Studios, the manufacturer of Passwordstate, has announced announced that its automatic update mechanism has been abused to offer malicious files for download. If you meet these criteria: - you are currently using version 9.1 build 9117, - Passwordstate applies updates automatically, - and t...
[SECURITY] Fedora 34 Update: clamav-0.103.2-1.fc34
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...
PT-2021-19425 · Mediawiki +1 · Abusefilter Extension +2
Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.35.2 AbuseFilter extension for MediaWiki versions through 1.35.2 Description: An issue in the AbuseFilter extension for MediaWiki improperly handled account blocks for certain automatically created MediaWiki user...
Cross-site scripting in papermerge
Multiple cross-site scripting XSS vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in...
Trend Micro Password Manager may insecurely load Dynamic Link Libraries
Overview Password Manager provided by Trend Micro Incorporated contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact...
FreeBSD : curl -- Automatic referer leaks credentials (b1194286-958e-11eb-9c34-080027f515ea)
Daniel Stenberg reports : libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request. libcurl...
Security Updates for Outlook (April 2021)
The Microsoft Outlook application installed on the remote host is missing security updates. It is, therefore, affected by a memory corruption vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable...
Security Updates for Microsoft Excel Products (April 2021)
The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - Microsoft Office Remote Code Execution Vulnerability CVE-2021-28449 - Microsoft Excel Remote Code Execution Vulnerability CVE-2021-28451, CVE-2021-28454, CVE-2021-28456 Note that...
The vulnerability of the automatic email decompression mechanism of Apple Mail on Apple Mac OS operating systems allows a hacker to write arbitrary files.
The vulnerability of the Apple Mail client’s automatic decompression mechanism in Apple Mac OS operating systems is related to incorrect handling of logical operations. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the /Library/Mail directory and $TMPDIR...
KB5001399: Servicing stack update for Windows 10: April 13, 2021
None None...
Invigo Automatic Device Management Remote Code Execution (CVE-2020-10580)
A remote code execution vulnerability exists in Invigo Automatic Device Management. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Invigo Automatic Device Management Command Injection (CVE-2020-10583)
A command injection vulnerability exists in Invigo Automatic Device Management. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Fedora: Security Advisory for clamav (FEDORA-2021-bedb7cc66e)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 33 Update: clamav-0.103.2-1.fc33
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...
CVE-2021-23005
The CVE-2021-23005 issue affects BIG-IQ high-availability (HA) when using a Quorum device for automatic failover; TLS is not used with the Corosync protocol, exposing in-transit data to potential eavesdropping/modification. Affected BIG-IQ HA versions are 7.x and 6.x; this is fixed in BIG-IQ 8.0....
CVE-2021-22995
On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ high availability HA when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development EoSD are not evaluated...