Django Denial-of-service in strip_tags()

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.striptags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities...

CVE-2019-14232

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability i...

The vulnerability of the Linux operating system’s kernel, related to the use of memory after it is freed, allows attackers to increase their privileges.

The vulnerability of the arch/x86/lib/insn-eval.c file in the Linux operating system is related to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2019-14232

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability i...

CVE-2019-14233

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.striptags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities...

Prima Systems FlexAir

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Prima Systems Equipment: FlexAir Vulnerabilities : OS Command Injection, Unrestricted Upload of File with Dangerous Type, Cross-site Request Forgery, Small Space of Random Values, Cross-site...

Zurmo 3.2.6 Out Of Band Code Evaluation

Out of Band Code Evaluation Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Out of Band Code Evaluation in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Out of Band Code Evaluation Severity: Critical...

Zurmo 3.2.6 Code Evaluation

Code Evaluation Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Code Evaluation Vulnerability in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Code Evaluation Severity: Critical Status: Not Fixed...

SIAM Conference on Applied Algebraic Geometry 2019 - Isogenies mini-symposium

So here we are in the nice city of Bern, in the Teutonic Switzerland, for SIAM Conference on Applied Algebraic Geometry 2019 that this year counts more than 750 attendees! The weather is warm enough but the isogenies topic has never been so hot! So for this occurrence of the conference Tanja Lang...

CVE-2019-1010023

CVE-2019-1010023 is reflected in OSV entries for Root OS Debian 12/13, where the rootio-glibc package is patched. The Debian-backed records indicate multiple fixed versions are available; the initial description notes a threat involving re-mapping a loaded ELF via two files and ldd, but upstream ...

RHEL 7 : ansible (RHSA-2019:1705)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:1705 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does n...

SQL Injection Vulnerability in Bid Evaluation Expert Pool System V1.0

Gansu Chengxing Information Technology Co., Ltd. developed to meet the needs of various types of public resource transactions, can provide timely, reliable and effective support for the Chengxing public resource trading platform. SQL injection vulnerability exists in the bid evaluation expert...

ansible: unsafe template evaluation of returned module data can lead to information disclosure

A flaw was discovered in the way Ansible templating was implemented, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed...

ansible: unsafe template evaluation of returned module data can lead to information disclosure

A flaw was discovered in the way Ansible templating was implemented, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed...

Cross-Site Scripting (XSS)

antixss is vulnerable to cross-site scripting XSS. The library does not properly evaluate characters after the detection of a Cascading Style Sheets CSS escaped character, which allows remote attackers to conduct cross-site scripting XSS attacks via HTML input...

UBUNTU-CVE-2019-13233

In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modifyldt and a BR exception for an MPX bounds violation...

Memory corruption

Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service. When connected to the "Blip" open wireless connection provided by the device, if a large string is sent as a part of the HTTP request in any part of the HTTP headers, the device coul...

CVE-2017-11580

Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service. When connected to the "Blip" open wireless connection provided by the device, if a large string is sent as a part of the HTTP request in any part of the HTTP headers, the device coul...

Leaky Amazon S3 Buckets Expose Data of Netflix, TD Bank

Three publicly-accessible cloud storage buckets from data management company Attunity leaked more than a terabyte of data from its top Fortune 100 customers – including internal business documents, system passwords, sensitive employee information. Israel-based Attunity, which was acquired by Qlik...

Open Faculty Evaluation System SQL Injection Vulnerability (CNVD-2019-18736)

Open Faculty Evaluation System is a PHP and MySQL based teacher evaluation system. The system provides Web-based graphical reports and Excel file reports, and supports student subject ratings for teachers. A SQL injection vulnerability exists in the submitfeedback.php file in Open Faculty...