3286 matches found
D-Link DIR-859 Information Disclosure Vulnerability
The D-Link DIR-859 is a wireless AC1750 high power Wi-Fi Gigabit router. An information disclosure vulnerability exists in D-Link DIR-859 versions prior to 1.07b03beta, which can be exploited by an attacker to obtain information via the AUTHORIZEDGROUP=1%0a value...
Design/Logic Flaw
Halo before 1.2.0-beta.1 allows Server Side Template Injection SSTI because TemplateClassResolver.SAFERRESOLVER is not used in the FreeMarker configuration...
CVE-2019-19999
Halo before 1.2.0-beta.1 allows Server Side Template Injection SSTI because TemplateClassResolver.SAFERRESOLVER is not used in the FreeMarker configuration...
Halo Code Issue Vulnerability
Halo is a personal blogging system. A security vulnerability exists in Halo versions prior to 1.2.0-beta.1. An attacker can exploit the vulnerability to execute commands...
knockout: Cross-site Scripting (XSS) attacks due to not escaping the name attribute.
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...
GHSA-6XC2-MJ39-Q599 Strapi allows unauthenticated attacker to reset admin password without valid reset token
Versions of strapi prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token. Recommendation Upgrade to version 3.0.0-beta.17.5 or later...
Apache ZooKeeper < 3.4.14, 3.5.0-alpha - 3.5.4-beta Information Disclosure Vulnerability
Apache ZooKeeper is prone to an information disclosure vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
Haml vulnerable to cross-site scripting
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...
DEBIAN-CVE-2019-6473
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process kea-dhcp4, causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2...
CVE-2017-1002201
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...
MetInfo SQL Injection Vulnerability (CNVD-2020-14278)
MetInfo is a content management system CMS developed by China Mito MetInfo using PHP and Mysql. A SQL injection vulnerability exists in MetInfo 7.0.0 beta, which stems from a lack of validation of externally entered SQL statements in database-based applications and can be exploited by an attacker...
Fedora 31 : python38 (2019-d11594bf0a)
This is a beta preview of Python 3.8 Python 3.8 is still in development. This release, 3.8.0b4 is the last of four planned beta release previews. Beta release previews are intended to give the wider community the opportunity to test new features and bug fixes and to prepare their projects to...
PT-2019-5531 · Ignite Realtime · Openfire
Name of the Vulnerable Software and Affected Versions: Openfire versions through 4.4.2 Description: A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java allows attackers to send arbitrary HTTP GET requests. The issue is related to insufficient validation of incoming requests,...
Reason Security opens beta for business edition & cuts yearly subscription price
By Waqas Privacy-oriented security solution Reason Security previously focused on personal security, offering a privacy-oriented antivirus solution to consumers. This is a post from HackRead.com Read the original post: Reason Security opens beta for business edition & cuts yearly subscription pri...
GandCrab Operators Resurface with REvil Malware
The malware that hit 22 Texas municipalities and various dentist offices around the country recently is likely the work of the crew behind the GandCrab ransomware – indicating that the group didn’t really retire after all. In late May, the GandCrab operators said they decided to ride off into the...
Mozilla Launches 'Firefox Private Network' VPN Service as a Browser Extension
Mozilla has officially launched a new privacy-focused VPN service, called Firefox Private Network , as a browser extension that aims to encrypt your online activity and limit what websites and advertisers know about you. Firefox Private Network service is currently in beta and available only to...
Fedora 29 : python38 (2019-d58eb75449)
This is a beta preview of Python 3.8 Python 3.8 is still in development. This release, 3.8.0b4 is the last of four planned beta release previews. Beta release previews are intended to give the wider community the opportunity to test new features and bug fixes and to prepare their projects to...
Fedora 30 : python38 (2019-4954d8773c)
This is a beta preview of Python 3.8 Python 3.8 is still in development. This release, 3.8.0b4 is the last of four planned beta release previews. Beta release previews are intended to give the wider community the opportunity to test new features and bug fixes and to prepare their projects to...
CloudBees Jenkins Fabric Beta Publisher Plugin Trust Management Issue Vulnerability
CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Fabric Beta Publisher Plugin is used in one of the Android application publishing...