CVE-2019-10912

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to...

CVE-2019-10912

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to...

[SECURITY] Fedora 29 Update: memcached-1.5.14-1.fc29

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load...

[SECURITY] Fedora 30 Update: memcached-1.5.14-1.fc30

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load...

Fedora Update for geocode-glib FEDORA-2019-27e7b92407

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for bind-dyndb-ldap FEDORA-2019-f791948895

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: bind-dyndb-ldap-11.1-15.fc30

This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server...

USN-3963-1: Memcached vulnerability

It was discovered that Memcached incorrectly handled certain lru command messages. A remote attacker could possibly use this issue to cause Memcached to crash, resulting in a denial of service...

CVE-2019-11244

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the...

CVE-2019-11244

CVE-2019-11244 affects Kubernetes kubectl caching: in Kubernetes v1.8.x–v1.14.x, schema info is cached in a world-writable directory by default at --cache-dir (often $HOME/.kube/http-cache). If the cache-dir is accessible to other users, files may be modified and disrupt kubectl invocation. Publi...

[SECURITY] Fedora 30 Update: geocode-glib-3.26.1-2.fc30

geocode-glib is a convenience library for the geocoding finding longitude, and latitude from an address and reverse geocoding finding an address from coordinates. It uses Nominatim service to achieve that. It also caches reverse-geocoding requests for faster results and to avoid unnecessary se rv...

`kubectl --http-cache=<world-accessible dir>` creates world-writeable cached schema files

In kubectl v1.8.0+, schema info is cached in the location specified by --cache-dir defaulting to $HOME/.kube/http-cache, written with world-writeable permissions rw-rw-rw-. If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be...

[SECURITY] Fedora 30 Update: yaws-2.0.6-1.fc30

HTTP 1.0 and HTTP 1.1 web server capable of both static content page delivery and dynamic content generation using embedded Erlang code in the HTML pages. It provides virtual hosting capabilities and implements HTTP tracing and other debugging functionality such as interactive interpreter...

XSLeaks attack analysis-HTTP caching and cross-site leakage-vulnerability warning-the black bar safety net

0x1 XSSearch past lives This attack is the earliest can be dated back to 10 years agoi.e. 2009, one named Chris Evans, security personnel describes one of the Yahoo attack: Chris use a malicious web site to search for the site visitor's e-mail Inbox, and he by constructing different keywords mann...

Ruby on Rails: File writing by Directory traversal at actionpack-page_caching and RCE by it

I found a directory traversal in actionpack-pagecaching. Some code may lead to RCE. https://github.com/rails/actionpack-pagecaching/blob/master/lib/actioncontroller/caching/pages.rbL143 ruby def cachefilepath, extension if path.empty? || path = %r\A/+\z name = "/index" else name =...

FortiSIEM LDAP server password reflected in admin portal

An information exposure vulnerability in the admin portal of FortiSIEM may allow an authenticated admin to retrieve the LDAP server password via the HTML source code. This could potentially aggravate attacks targeting the authenticated admin session, should they exist XSS, social engineering, pro...

Security Bulletin: API Connect is affected by insecure caching (CVE-2018-1874)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1874 DESCRIPTION: IBM API Connect could display highly sensitive information to an attacker with physical access to the system. CVSS Base Score: 4.6 CVSS Temporal Score: See for the current...

XSS vulnerability with double-encoded entities

An XSS vulnerability CVE-2019-10010 has been identified in all previous versions of this library 0.18.2 and below. The issue has been fixed in version 0.18.3. All users should upgrade to version 0.18.3 immediately. Additionally, if your application caches the resulting HTML, please purge and/or...

Placeto CMS Alpha v4 - page SQL Injection

Placeto CMS Alpha v4 - page SQL Injection Placeto CMS Alpha v4 - 'page' SQL Injection Title: Placeto CMS Date: 21.03.2019 Exploit Author: Abdullah Çelebi Vendor Homepage: https://sourceforge.net/projects/placeto/ Software Link: https://sourceforge.net/projects/placeto/files/alpha-rv.4/placeto.zip...

PayPal: Bypass for #488147 enables stored XSS on https://paypal.com/signin again

Due to a configuration in frontend, caching servers, it was possible for a researcher to use request smuggling to convert a page request into a cached redirect. If the cached redirect were accessed by a legitimate user, an attacker's content would be rendered instead of the requested page. While...