CVE-2019-6713: Improper Control of Generation of Code

app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a fileputcontents call...

UBUNTU-CVE-2019-3460

A heap data infoleak in multiple locations including L2CAPPARSECONFRSP was found in the Linux kernel before 5.1-rc1...

PT-2019-4656

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.1-rc1 Description A heap data infoleak was found in multiple locations, including the L2CAP PARSE CONF RSP function, in the Linux kernel. This issue is related to a buffer overflow in the heap, which can be...

PT-2019-4657

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.1-rc1 Description A heap address information leak was discovered in the Linux kernel, related to the function L2CAP GET CONF OPT. This issue is associated with a buffer overflow in the heap, which can be...

XXL-CONF Path Traversal vulnerability

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

GHSA-8J39-FGFP-VXH8 XXL-CONF Path Traversal vulnerability

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

Directory Traversal

xxl-conf-core is vulnerable to directory traversal attacks. The vulnerable exists due to the lack of sanitization on the value of pathname, allowing the download of any configuration file using the ../ characters...

CVE-2018-20094

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

Path traversal

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

CVE-2018-20094

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

CVE-2018-20094

CVE-2018-20094 affects XXL-CONF 1.6.0 via a path-traversal flaw in the keys parameter that can download arbitrary configuration files. The root cause is described as insufficient validation in ConfController.java and PropUtil.java, enabling an attacker to access sensitive configuration data. The ...

CVE-2018-20094

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

PT-2018-15254

Name of the Vulnerable Software and Affected Versions XXL-CONF version 1.6.0 Description The issue is related to a path traversal vulnerability via ../ in the keys parameter, which can be used to download any configuration file. This is associated with ConfController.java and PropUtil.java...

CVE-2018-20094: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java...

libvirt security, bug fix, and enhancement update

4.5.0-10 - conf: correct false boot order error during domain parse rhbz1601318 4.5.0-9 - virDomainDefCompatibleDevice: Relax alias change check rhbz1621910 - virDomainDetachDeviceFlags: Clarify update semantics rhbz1621910 - virDomainNetDefCheckABIStability: Check for MTU change too rhbz1623157...

UBUNTU-CVE-2018-14055

ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf...

CVE-2018-12257

An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with CLI access is able to remotely upgrade firmware to a custom image due to lack of SSL validation by changing the nameservers in...

libvirt security and bug fix update

3.9.0-14.el75.4 - lxc: Drop useless check in live device update rhbz1557922 - Pass oldDev to virDomainDefCompatibleDevice on device update rhbz1557922 - qemu: Fix updating device with boot order rhbz1557922 - conf: Fix crash in virDomainDefCompatibleDevice rhbz1557922 - vmx: check for...

DEBIAN-CVE-2016-9590

puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage swift. During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf...

Icinga Arbitrary Code Execution Vulnerability

Icinga is an open source computer system and network monitoring application. Icinga suffers from an arbitrary code execution vulnerability. An attacker can make Icinga 2 run with root privileges by editing the init.conf file, which can be used to execute arbitrary code with root privileges...