8873 matches found
Open redirect
SAP Solution Manager Trace Analysis, version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the...
Patch Tuesday - December 2020
We close off our 2020 year of Patch Tuesdays with 58 vulnerabilities being addressed. While it's a higher count than our typical December months high thirties, it's still a nice breath of fresh air given how the past year has been. We do, however, get to celebrate that none of the reported...
December 8, 2020—KB4592446 (OS Build 17134.1902) - EXPIRED
None None...
CVE-2020-26255 PHP Phar archives could be uploaded and executed in Kirby
Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of...
Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5
Impact An editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors...
CVE-2020-17531
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to...
Deserialization of untrusted data
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to...
December 8, 2020—KB4592484 (Monthly Rollup)
None None...
December 8, 2020—KB4593226 (OS Build 14393.4104) - EXPIRED
None None...
December 8, 2020—KB4592495 (Security-only update)
None None...
December 8, 2020—KB4592471 (Monthly Rollup)
None None...
CVE-2020-17531
CVE-2020-17531 affects Apache Tapestry 4. It describes a Java deserialization vulnerability where the server will deserialize the sp parameter before page validation, allowing deserialization without authentication. Tapestry 4 is end-of-life (2008) and no fix will be released; Tapestry 5 is not a...
PT-2020-15035 · Apache · Apache Tapestry
Name of the Vulnerable Software and Affected Versions: Apache Tapestry version 4 Description: A Java Serialization vulnerability was found in Apache Tapestry 4, where it attempts to deserialize the sp parameter before invoking the page's validate method, leading to deserialization without...
CVE-2020-17531 Deserialization flaw in EOL Tapestry 4.
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to...
December 8, 2020—KB4592473 (OS Build 15063.2584)
None None...
HPESBNW04072 rev.2 - HPE ArubaOS, Multiple Remote Vulnerabilities
Potential Security Impact: Remote: Arbitrary Code Execution, Arbitrary Command Execution, Compromise of System Integrity SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 7000 Series Mobility Controllers 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and bel...
Debian DLA-2482-1 : debian-security-support security update
debian-security-support, the Debian security support coverage checker, has been updated in stretch-security. This marks the end of life of the mongodb package in stretch due to licence incompatibility. See https://lists.debian.org/debian-lts/2020/11/msg00058.html and https://bugs.debian.org/91553...
Command Injection
Firejail is vulnerable to command injection. The vulnerability exist because the end-of-option indicator after the --output option is not checked...
How Organizations Can Prevent Users from Using Breached Passwords
There is no question that attackers are going after your sensitive account data. Passwords have long been a target of those looking to compromise your environment. Why would an attacker take the long, complicated way if they have the keys to the front door? No matter how extensive your security...
Veeam Agent for Linux install on EOL CentOS fails with a repository error
Challenge When installing Veeam Agent for Linux on a version of CentOS that has reached End of Life, the install fails with messages similar to the following: CentOS 8: Error: Failed to download metadata for repo 'appstream': Cannot prepare internal mirrorlist: No URLs in mirrorlist Copy CentOS 6...