Information Disclosure

apache arrow is vulnerable to information disclosure. The data read from Apache Parquet files with RLE null encoded data is uninitialized, potentially allowing data in memory to be unintentionally shared over the wire...

SUSE-SU-2019:2744-2 Security update for openconnect

This update for openconnect fixes the following issues: - CVE-2019-16239: Fixed a buffer overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes. bsc1151178...

Node.js: HTTP request smuggling using malformed Transfer-Encoding header

Please see the attached PDF for a writeup of this vulnerability. Impact Please see the attached PDF for a writeup of this vulnerability...

Security update for python-ecdsa (moderate)

openSUSE Security Update: Security update for python-ecdsa Announcement ID: openSUSE-SU-2019:2474-1 Rating: moderate References: 1153165 1154217 Cross-References: CVE-2019-14853 CVE-2019-14859 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now...

Security update for python-ecdsa (moderate)

openSUSE Security Update: Security update for python-ecdsa Announcement ID: openSUSE-SU-2019:2472-1 Rating: moderate References: 1153165 1154217 Cross-References: CVE-2019-14853 CVE-2019-14859 Affected Products: openSUSE Leap 15.0 An update that fixes two vulnerabilities is now...

PYSEC-2019-196

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...

CVE-2019-12410

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...

CVE-2019-12331

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml...

CVE-2019-12331

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml...

Xxe

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml...

CVE-2019-12331

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml...

PT-2019-12758 · Phpoffice · Phpoffice Phpspreadsheet

Name of the Vulnerable Software and Affected Versions: PHPOffice PhpSpreadsheet versions prior to 1.8.0 Description: The issue arises from the XmlScanner decoding sheet1.xml from an .xlsx file to utf-8 if a different encoding is declared in the header. This was initially intended as a security...

CVE-2019-10495

Arbitrary buffer write issue while processing sequence header during HEVC or AVC encoding. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU,...

Phishing Attack

openssh is vulnerable to phishing attack. The vulnerability exists as a missing character encoding in progress display allows for spoofing of scp client output...

Parallels Plesk Panel 9.5 Cross Site Scripting

Exploit Title: Parallels Plesk Panel 9.5 Reflected XSS Release Date: 06/11/2019 Author: Cyber Citadel Website: www.cybercitadel.com Vendor: www.plesk.com Versions 9.5 Description A Cross Site Scripting vulnerability occurs when an attacker can inject JavaScript in context of the web application...

RHEL 8 : openssh (RHSA-2019:3702)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3702 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

openssh: Missing character encoding in progress display allows for spoofing of scp client output

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This...

Unspecified Vulnerability in Cisco Adaptive Security Appliance Software

Cisco Adaptive Security Appliances Software ASA Software is a suite of firewall and network security platforms from Cisco. A security vulnerability exists in the Secure Sockets Layer SSL VPN feature of Cisco ASA Software, which stems from the program not properly handling Base64 encoded strings. ...

[ASA-201911-4] python2: information disclosure

Arch Linux Security Advisory ASA-201911-4 ========================================= Severity: High Date : 2019-11-03 CVE-ID : CVE-2019-9636 Package : python2 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-978 Summary ======= The package python2 before version...

Cross site scripting

Multiple Reflected Cross-site Scripting XSS vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input encoded in base64. This also applies to the search functionality for the searchKey parameter...