ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats...

PT-2018-13775

Name of the Vulnerable Software and Affected Versions Ansible Engine versions prior to 2.9 Description The issue allows for 'become' passwords to appear in EventLogs in plaintext when executing Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled. ...

Vanilla Cross-Site Scripting Vulnerability

Vanilla is an open source multi-language, fully extensible forum program. A cross-site scripting vulnerability exists in Vanilla versions prior to 2.6.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the email field in the basic information...

Lenovo XClarity Administrator Parameter Injection Vulnerability

Lenovo XClarity Administrator LXCA is a centralized resource management solution from Lenovo, China. The solution supports simplified infrastructure management, faster server response, and improved performance of Lenovo server systems. A parameter injection vulnerability exists in the Web API in...

CVE-2018-12981

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be...

CVE-2018-12980

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server...

Micro Focus SUSE open build service unauthorized source access vulnerability

Micro Focus SUSE open build service OBS is a software distribution system from Micro Focus UK. The system builds and distributes software packages from source code in an automated, consistent and repeatable manner. A security vulnerability exists in Micro Focus SUSE OBS versions 2.1 through 2.1.1...

UBUNTU-CVE-2011-4181

A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 for 2.1 and before version 2.3...

WordPress Ultimate Member Plugin Arbitrary File Upload Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers.Ultimate Member is one of the plug-ins used to create a membership site or online community. An arbitrary file upload...

CVE-2018-5226

There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An attacker with permission to create a tag on a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the...

Mautic cross-site scripting vulnerability (CNVD-2018-08601)

Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A cross-site scripting vulnerability exists in versions of Mautic prior to 2.13.0. A remote attacker can exploit this vulnerability to inject arbitrary...

CVE-2018-1238

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent LIA. This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge...

GNU C Library 'glob' Function Buffer Overflow Vulnerability

The GNU C Library aka glibc, libc6 is an open-source, free C language compiler released under the LGPL license. A buffer overflow vulnerability exists in the 'glob' function of the glob.c file in versions of the GNU C Library prior to 2.27. A remote attacker could exploit this vulnerability to...

CVE-2017-15909

D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded password, which allows remote attackers to obtain shell access...

Cross-site request forgery vulnerability in phpMyFAQ admin/stat.ratings.php file

phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A cross-site request forgery vulnerability exists...

YADIFA DNS Packet Parser Denial of Service Vulnerability

YADIFA is a lightweight authoritative name server with DNSSEC capabilities.DNS packet parser is one of the Domain Name System DNS resolvers. A security vulnerability exists in the DNS packet parser in versions of YADIFA prior to 2.2.6, which stems from the program failing to detect the presence o...

Pivotal Software Cloud Foundry cf-release and CAPI-release denial of service vulnerabilities

Pivotal Software Cloud Foundry CF is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from Pivotal Software in the United States, which provides container scheduling, continuous delivery, and automated service deployment, among other capabilities. cf-release and...

DEBIAN-CVE-2015-1395

Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. dot dot in a diff file name...

ALPINE-CVE-2014-4616

Array index error in the scanstring function in the json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the rawdecode function...

CloudView NMS Cross-Site Scripting Vulnerability

CloudView NMS is a network management and monitoring system that automatically discovers, monitors and performs tasks from CloudView NMS USA. A cross-site scripting vulnerability exists in CloudView NMS versions prior to 2.10a. A remote attacker can exploit this vulnerability to inject arbitrary...