[SECURITY] [DSA 4905-1] shibboleth-sp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4905-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 27, 2021 https://www.debian.org/security/faq -...

sbibboleth-sp -- denial of service vulnerability

Shibboleth project reports: Session recovery feature contains a null pointer deference. The cookie-based session recovery feature added in V3.0 contains a flaw that is exploitable on systems not using the feature if a specially crafted cookie is supplied. This manifests as a crash in the shibd...

CVE-2020-7848

The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability, an attacker can send a GET request that executes arbitrary OS commands via cookie value...

CVE-2020-7848

The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability, an attacker can send a GET request that executes arbitrary OS commands via cookie value...

CVE-2020-26768

Formstone =1.4.16 is vulnerable to a Reflected Cross-Site Scripting XSS vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in...

CVE-2020-24902

Quixplorer =2.4.1 is vulnerable to reflected cross-site scripting XSS caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web...

Cross site scripting

Formstone =1.4.16 is vulnerable to a Reflected Cross-Site Scripting XSS vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in...

PT-2021-11270

Name of the Vulnerable Software and Affected Versions: Formstone versions 1.4.16 and earlier Description: The issue is caused by improper validation of user-supplied input in the upload-target.php and upload-chunked.php files, leading to a Reflected Cross-Site Scripting XSS vulnerability. A remot...

PT-2021-11082

Name of the Vulnerable Software and Affected Versions: Cute Editor for ASP.NET version 6.4 Description: The issue is caused by improper validation of user-supplied input, leading to reflected cross-site scripting XSS. A remote attacker could exploit this using a specially crafted URL to execute a...

Cross site scripting

HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting XSS vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security...

CVE-2020-14271

HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting XSS vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the...

PT-2020-17867

Name of the Vulnerable Software and Affected Versions HCL Verse versions 10 through 11 Description The issue arises from improper handling of message content, leading to a Stored Cross-Site Scripting XSS vulnerability. An unauthenticated remote attacker could exploit this by using specially-craft...

PT-2020-13957

Name of the Vulnerable Software and Affected Versions HCL iNotes versions 9 through 11 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using...

Security Bulletin: A security vulnerability in angular.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Service.

Summary A security vulnerability in angular.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Service. Vulnerability Details CVEID: CVE-2020-7676 DESCRIPTION: angular.js is vulnerable to cross-site scripting, caused by improper validation of user-supplied...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Content Classification

Summary There are multiple vulnerabilities in IBM® SDK Java Technology Edition, Version 6 and IBM® Runtime Environment Java Version 7 used by IBM Content Classification. These issues were disclosed as part of the IBM Java SDK updates in Jul 2019. Vulnerability Details CVEID: CVE-2019-10241...

Security Bulletin: A security vulnerability in GO affects IBM Cloud Automation Manager.

Summary A security vulnerability in GO affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2020-24553 DESCRIPTION: Golang Go is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the CGI/FCGI handlers. A remote attacker could exploit thi...

PT-2020-13949

Name of the Vulnerable Software and Affected Versions HCL Notes versions prior to 9.0.1 FP10 IF8 HCL Notes versions prior to 10.0.1 FP6 HCL Notes versions prior to 11.0.1 FP1 Description The issue is a Stored Cross-site Scripting XSS vulnerability. An attacker could use this vulnerability to...

Artica Proxy 4.30.000000 Authentication Bypass / Command Injection Exploit

This Metasploit module exploits an authenticated command injection vulnerability in Artica Proxy, combined with an authentication bypass discovered on the same version, it is possible to trigger the vulnerability without knowing the credentials. The application runs in a virtual appliance and...

Security Bulletin: A vulnerability in Apache ActiveMQ affects IBM Operations Analytics Predictive Insights (CVE-2020-1941)

Summary Apache ActiveMQ is used by IBM Operations Analytics Predictive Insights. IBM Operations Analytics Predictive Insights has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-1941 DESCRIPTION: Apache ActiveMQ is vulnerable to cross-site scripting, caused by improper...

CVE-2012-3341

IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of...