comelz Quark path traversal vulnerability

comelz Quark is a Python based project dependency management system. A path traversal vulnerability exists in versions of comelz Quark prior to 2019-03-26, which can be exploited by an attacker to access locations outside of a restricted directory...

GitLab: Container scanning and Dependency scanning report leaked to unauthorized users

Hi GitLab Security team Summary GitLab makes the container scanning and dependency scanning information available as part of a JSON endpoint for merge requests. These reports are output of the CI job and should only be displayed if the visiting user has access to CI. However, right now GitLab...

traefik -- Denial of service in HTTP/2

The traefik project reports: Update of dependency to go go1.12.8 resolves potential HTTP/2 denial of service in traefik...

Ghidra (Linux) 9.0.4 Arbitrary Code Execution

import os import inspect import argparse import shutil from shutil import copyfile print"" print"" print"" print"" print"------------------CVE-2019-13623----------------" print"" print"" print"" print"-----------------Ghidra-Exploit-----------------" print"--Tested version: Ghidra Linux version =...

Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution Exploit

import os import inspect import argparse import shutil from shutil import copyfile print"" print"" print"" print"" print"------------------CVE-2019-13623----------------" print"" print"" print"" print"-----------------Ghidra-Exploit-----------------" print"--Tested version: Ghidra Linux version =...

Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution

Ghidra Linux 9.0.4 - .gar Arbitrary Code Execution import os import inspect import argparse import shutil from shutil import copyfile print"" print"" print"" print"" print"------------------CVE-2019-13623----------------" print"" print"" print""...

nss and nspr security, bug fix, and enhancement update

nspr 4.21.0-2 - Rebuild 4.21.0-1 - Update to NSPR 4.21 nss 3.44.0-7 - Backport fixes from 3.44.1 3.44.0-6 - Add continuous RNG test required by FIPS - fipstest: use CKMTLS12MASTERKEYDERIVE instead of vendor specific mechanism 3.44.0-5 - Rebuild with the correct build target 3.44.0-4.1 - rebuild t...

satellite-5-client module update

An update is available for dnf-plugin-spacewalk, rhn-client-tools, rhnsd, rhnlib. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Satellite 5 client module...

virt:rhel security update

4.5.0-23.2.0.1.el8 - added librbd1 as dependency Keshav Sharma 4.5.0-23.2.el8 - admin: reject clients unless their UID matches the current UID CVE-2019-10132 - locking: restrict sockets to mode 0600 CVE-2019-10132 - logging: restrict sockets to mode 0600 CVE-2019-10132 4.5.0-23.1.el8 - cpux86: Do...

CVE-2019-1020007

Dependency-Track before 3.5.1 allows XSS...

CVE-2019-1020007

Dependency-Track before 3.5.1 allows XSS...

Cross site scripting

Dependency-Track before 3.5.1 allows XSS...

CVE-2019-1020007

Dependency-Track (before version 3.5.1) is affected by CVE-2019-1020007, a cross-site scripting (XSS) vulnerability. The connected documents confirm XSS but do not provide details on root cause, exploit specifics, or a listed fix within the provided data.

CVE-2019-1020007

Dependency-Track before 3.5.1 allows XSS...

CloudBees Jenkins Unauthorized Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Dependency Graph Viewer Plugin is used in...

Jenkins Dependency Graph View Plugin Cross-Site Scripting (CVE-2019-10349)

A Cross-Site Scripting vulnerability exists in Jenkins Dependency Graph View plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

SUSE-SU-2019:1830-1 Security update for glib2

This update for glib2 fixes the following issues: Security issue fixed: - CVE-2019-13012: Fixed improper restriction of file permissions when creating directories bsc1139959. Non-security issue fixed: - Added explicit requires between libglib2 and libgio2 bsc1140122...

Jenkins Dependency Graph View Plugin 0.13 - Persistent Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Persistent XSS - Dependency Graph View Pluginv0.13 Vendor Homepage: https://wiki.jenkins.io/display/JENKINS/Dependency+Graph+View+Plugin Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website:...

Jenkins Dependency Graph View 0.13 Cross Site Scripting

Exploit Title: Persistent XSS - Dependency Graph View Pluginv0.13 Vendor Homepage: https://wiki.jenkins.io/display/JENKINS/Dependency+Graph+View+Plugin Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: webapps Platform:...