[SECURITY] [DLA 3152-1] glibc security update

Debian LTS Advisory DLA-3152-1 [email protected] https://www.debian.org/lts/security/ Helmut Grohne October 17, 2022 https://wiki.debian.org/LTS Package : glibc Version : 2.28-10+deb10u2 CVE ID : CVE-2016-10228 CVE-2019-19126 CVE-2019-25013 CVE-2020-1752 CVE-2020-6096 CVE-2020-10029...

OWASP ModSecurity Core Rule Set 安全漏洞

The OWASP ModSecurity Core Rule Set CRS is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. A security vulnerability exists in OWASP ModSecurity Core Rule Set CRS that originates in the Character Set Acceptance header field, which results i...

[SECURITY] Fedora 36 Update: golang-github-axgle-mahonia-0-0.14.20181112git3358181.fc36

Mahonia is a character-set conversion library implemented in Go. All data is compiled into the executable; it doesn't need any external data files...

[SECURITY] Fedora 35 Update: golang-github-axgle-mahonia-0-0.13.20181112git3358181.fc35

Mahonia is a character-set conversion library implemented in Go. All data is compiled into the executable; it doesn't need any external data files...

[SECURITY] Fedora 36 Update: golang-github-axgle-mahonia-0-0.13.20181112git3358181.fc36

Mahonia is a character-set conversion library implemented in Go. All data is compiled into the executable; it doesn't need any external data files...

Better Notifications for WP < 1.8.7 - Email Address Disclosure

The plugin does not have authorisation and CSRF check in its bnfwsearchusers AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes finding the first letter, then the second one, then the third one etc.. import sys import string import urllib.parse import...

Huawei EulerOS: Security Advisory for python-rtslib (EulerOS-SA-2021-2164)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-10113

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

CVE-2020-10113

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

Design/Logic Flaw

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

UBUNTU-CVE-2019-5718

In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the RTSE dissector and other ASN.1 dissectors could crash. This was addressed in epan/charsets.c by adding a gett61string length check...

Cross site scripting

An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted...

CVE-2018-11330

An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted...

CVE-2018-11330

Pluck CMS (before 4.7.6) is affected by an authenticated stored XSS vulnerability due to improper restriction of the character set for filenames. This is consistently reported across CVE-2018-11330 entries in NVD, Red Hat, CNVD, OSV, and related records. No exploit details or remediation version ...

CVE-2018-11330

An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted...

Fedora 26 : glibc (2017-2c63df4fe3)

This update addresses various minor issues in the glibc package : - The DNS stub resolver now picks up changes to /etc/resolv.conf automatically RHBZ1374239. - The DNS stub resolver supports an unlimited number of search domains RHBZ168253. - CVE-2015-5180, a segmentation fault potentially...

[SECURITY] Fedora 25 Update: recode-3.6-43.fc25

The recode' converts files between character sets and usages. It recognizes or produces nearly 150 different character sets and is able to transliterate files between almost any pair. When exact transliteration are not possible, it may get rid of the offending characters or fall back on...

SQL Injection

opencart is vulnerable to SQL injection attacks. It is possible because it uses improper character set in mysql.php at the server level, allowing the attackers to perform multi-byte attack...

CVE-2017-9853

An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited set of...

Default credentials

DISPUTED An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited s...