ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2019-04686)

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras and more. A cross-site scripting vulnerability exists in the build of SQL-ERR messages in the includes/database.php file of ZoneMinder versions prior to 1.32.3, which can be exploited b...

DEBIAN-CVE-2019-8425

includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages...

UBUNTU-CVE-2019-8425

includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages...

Microsoft Dynamics 365 (online and on-premises) Update 8.2.3

None None...

High Disk Space Usage on Citrix ADM Causes MAS GUI Inaccessibility

High Disk space usage on Citrix ADM Unable to login to the ADM through GUI / CLI. df -h output shows close to 100% Disk utilization. 150GB of disk space was consumed by /var/mps/dbpgsql/data/pglog. The DB log file indicates thatlot of error messages related to MAS DB went Read-Replica mode. This...

Information Disclosure

PostgreSQL is vulnerable to information disclosure. An information leak occurs when the server handles certain error messages, allowing an authenticated database user could to obtain results of a query they did not have privileges to execute, by observing the constraint violation error messages...

Security Bulletin: Detailed Error Messages are Revealed in IBM Emptoris Supplier Lifecycle Management

Summary IBM Emptoris Supplier Lifecycle Management product reveals detailed error messages in certain features. Vulnerability Details CVEID: CVE-2018-1942 DESCRIPTION: IBM Emptoris Supplier Lifecycle Management could disclose highly sensitive information in detailed error messages. CVSS Base Scor...

Security update for Chromium (important)

This update to Chromium 71.0.3578.98 fixes the following issues: Security issues fixed boo1118529: - CVE-2018-17480: Out of bounds write in V8 - CVE-2018-17481: Use after frees in PDFium - CVE-2018-18335: Heap buffer overflow in Skia - CVE-2018-18336: Use after free in PDFium - CVE-2018-18337: Us...

IBM Security Access Manager Information Disclosure Vulnerability (CNVD-2018-25399)

IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. An information disclosure vulnerability exists in IBM Security Access Manager...

Security Bulletin: Detailed Error Messages Vulnerability Affects IBM Emptoris Contract Management (CVE-2018-1961)

Summary IBM Emptoris Contract Management product reveals detailed error messages in certain features that might be vulnerable to attacks. Vulnerability Details CVEID: CVE-2018-1961 DESCRIPTION: IBM Emptoris Contract Management could disclose sensitive information from detailed information from...

Syhunt ScanTools 6.5 - Console Web Vulnerability Scan Tools

Syhunt ScanTools comes with four console applications: ScanURL, ScanCode, ScanLog and ScanConf, incorporating the functionality of the scanners Syhunt Dynamic, Syhunt Code, Syhunt Insight and Syhunt Harden respectively. Whether you want to scan a live web application, source code files, a GIT...

CVE-2018-1935

IBM Connections 5.0, 5.5, and 6.0 could allow an authenticated user to obtain sensitive information from invalid request error messages. IBM X-Force ID: 153315...

CVE-2018-1935

IBM Connections 5.0, 5.5, and 6.0 could allow an authenticated user to obtain sensitive information from invalid request error messages. IBM X-Force ID: 153315...

Uber: [usuppliers.uber.com] - Server Side Request Forgery via XXE OOB

It was possible to determine open internal ports on an usuppliers.uber.com server, via examination of different error messages to a specific POST request made with various payloads. This error message discrepancy would allow an attacker to discover open internal ports, potentially allowing more...

USN-3805-1: curl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Harry Sintonen discovered that curl incorrectly handled SASL authentication. A remote attacker could use this issue to cause curl to crash, resulting in a...

HackerOne: Verbose PHP error messages exposed on a blog article

Hey guys! For what its worth, warning messages aren't suppressed on the /blog/ endpoint, giving verbose PHP error messages when visiting a blog article such as https://www.hackerone.com/blog/H1-702-2018-makes-history-over-500K-bounties-paid. F374066 Impact Not much impact, just disclosures of pat...

Information Disclosure Vulnerability in Multiple IBM Products (CNVD-2019-01574)

IBM Rational Collaborative Lifecycle Management is a collaborative lifecycle management solution. IBM Rational Collaborative Lifecycle Management is a collaborative lifecycle management solution; Rational Quality Manager is a collaborative, Web-based quality management solution; IBM Jazz is one o...

CVE-2018-1606

IBM Jazz based applications IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational DOORS Next Generation 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational Quality...

Debian DSA-4331-1 : curl - security update

Two vulnerabilities were discovered in cURL, an URL transfer library. - CVE-2018-16839 Harry Sintonen discovered that, on systems with a 32 bit sizet, an integer overflow would be triggered when a SASL user name longer than 2GB is used. This would in turn cause a very small buffer to be allocated...

USN-3805-2: curl vulnerability

USN-3805-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Brian Carpenter discovered that the curl command-line tool incorrectly handled error messages. A remote attacker could possibly use this issue to obtain sensiti...