[SECURITY] Fedora 29 Update: python-django-2.0.10-1.fc29

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Detecting Insecure Cookies with Qualys Web Application Scanning

Cookies are ubiquitous in today's modern web applications. If an attacker can acquire a user's session cookie by exploiting a cross-site scripting XSS vulnerability, by sniffing an unencrypted HTTP connection, or by some other means, then they can potentially hijack a user's valid session...

Debian DSA-4363-1 : python-django - security update

It was discovered that malformed URLs could spoof the content of the default 404 page of Django, a Python web development framework. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4363. The text itself is...

Guide to Developing a National Cybersecurity Strategy—a resource for policymakers to respond to cybersecurity challenges

Nations from every corner of the world are increasingly leveraging digital transformation to grow their economies and empower businesses to improve services, including vital services provided by critical infrastructures. This adoption of new information communications technologies ICT has...

mkcert: valid HTTPS certificates for localhost

or for any other names The web is moving to HTTPS, preventing network attackers from observing or injecting page contents. But HTTPS needs TLS certificates, and while deployment is increasingly a solved issue thanks to the ACME protocol and Let's Encrypt, development still mostly ends up happenin...

Debian DLA-1629-1 : python-django security update

It was discovered that there was a content-spoofing vulnerability in the default 404 pages in the Django web development framework. For more information, please see : https://www.djangoproject.com/weblog/2019/jan/04/security-releases/ For Debian 8 'Jessie', this issue has been fixed in...

Debian: Security Advisory (DSA-4363-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

2muchcoffee-react-scripts (0.1.0), 2muchcoffee-react-scripts2 (>=0.1.0, <=0.1.2) +993 more potentially affected by CVE-2018-14732 via webpack-dev-server (>=3.0.0, <=3.1.10)

webpack-dev-server NPM version =3.0.0, =0.1.0, =0.6.2, =2.1.1, =0.1.0, =1.0.0, =2.1.0-beta.0, =2.1.0-beta.0, =2.1.2-4, =2.2.0-beta.1, =1.0.0, =0.8.8, =0.12.0 and more Source cves: CVE-2018-14732 Source advisory: OSV:GHSA-CF66-XWFP-GVC4...

CVE-2018-17188

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

Design/Logic Flaw

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

SUSE SLED15 / SLES15 Security Update : Initial update for kernel-azure (SUSE-SU-2018:1952-1)

This update is the initial delivery of the Azure flavor of the Linux Kernel, which contains enhancements and optimizations for running the SUSE Linux Enterprise kernel in the Azure cloud. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE SLED15 / SLES15 Security Update : pam (SUSE-SU-2018:3965-1)

This update for pam fixes the following issue : Security issue fixed : CVE-2018-17953: Fixed IP address and subnet handling of pamaccess.so that was not honoured correctly when a single host was specified bsc1115640. Note that Tenable Network Security has extracted the preceding description block...

SQLite report about CVE-2019-19317

This CVE identifies a bug in a development check-in of SQLite. The bug never appeared in any official SQLite release. details...

Buffer Overflow Vulnerability in Hikvision Video Playback Library SDK

Hikvision Playback Library SDK is a secondary development kit related to playback of Hikvision embedded network DVRs, video servers, and supporting products for IP devices. A buffer overflow vulnerability exists in the Hikvision Video Playback Library SDK. An attacker can exploit the vulnerabilit...

Zhejiang Dahua Playback Library SDK suffers from denial-of-service vulnerability (CNVD-2019-00117)

Playback Library SDK is a development kit based on Dahua's private code stream encapsulation protocol developed to serve network DVRs, network video servers, network cameras, network dome cameras, intelligent devices and other products. A denial of service vulnerability exists in the Zhejiang Dah...

PT-2023-16570 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac/gpac versions prior to 2.3.0-DEV Description: A Heap-based Buffer Overflow issue has been identified. The estimated number of potentially affected devices and details about real-world incidents are not provided. Recommendations: For...

OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Sound. Supported versions that are affected are Java SE: 6u201, 7u191 and 8u182; Java SE Embedded: 8u181; JRockit: R28.3.19. Easily exploitable vulnerability allows unauthenticated attacker with...

NetChat v7.8 - Persistent Cross Site Scripting Vulnerability

Document Title: =============== NetChat v7.8 - Persistent Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2171 Video: https://www.vulnerability-lab.com/getcontent.php?id=2174...

SQL Injection Vulnerability in Fully Graphical Application Development Environment V2010

The full graphical application system development environment is developed by Jiangsu Lianbang Information Technology Co., Ltd. and is mainly used in the government, education industry, medical industry website. A SQL injection vulnerability exists in Full Graphical Application Development...

DevAudit - Open-source, Cross-Platform, Multi-Purpose Security Auditing Tool

DevAudit is an open-source, cross-platform, multi-purpose security auditing tool targeted at developers and teams adopting DevOps and DevSecOps that detects security vulnerabilities at multiple levels of the solution stack. DevAudit provides a wide array of auditing capabilities that automate...