Cross-site scripting in PHPMailer

PHPMailer versions prior to 5.2.24 released July 26th 2017 have an XSS vulnerability in one of the code examples, CVE-2017-11503. The codegenerator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it i...

Cross-site Scripting (XSS)

Cross-Origin Resource Sharing CORS Filter is vulnerable to cross-site scripting XSS attacks. The vulnerability exists because the returned exception messages in 'CORSOriginDeniedException' reflects the origin in the request header allowing an attacker to inject and execute arbitrary Javascript to...

Citrix App Layering - Error while trying to import layers

While trying to import layers, App Layering console displays an error: "An unexpected exception occurred. If this problem continues, contact Technical Support and provide them with the details of this exception". Looking at the ELM Web logs, we might see the below errors: ERROR 2832HandlerHelper:...

Updated upx packages fix security vulnerabilities

The updated packages fix security vulnerabilities: PackLinuxElf64::unpack in plxelf.cpp in UPX 3.95 allows remote attackers to cause a denial of service double free, limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a...

MGASA-2020-0096 Updated upx packages fix security vulnerabilities

The updated packages fix security vulnerabilities: PackLinuxElf64::unpack in plxelf.cpp in UPX 3.95 allows remote attackers to cause a denial of service double free, limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a...

Denial of Service

Overview Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERRHTTPHEADERSSENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the...

OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

[SECURITY] Fedora 30 Update: mbedtls-2.16.4-1.fc30

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

CVE-2020-7959

LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognize...

Design/Logic Flaw

LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognize...

CVE-2020-7959

LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognize...

Denial of Service

Overview Versions of @hapi/hapi prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the...

Denial of Service

Overview All Versions of hapi are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an...

Denial of Service

Overview Versions of @hapi/accept prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as oppose...

Denial of Service

Overview Versions of @commercial/ammo prior to 2.1.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the...

PT-2020-7857 · Ipsilon · Ipsilon

Name of the Vulnerable Software and Affected Versions: Ipsilon versions 0.1.0 through 1.0.0 Description: The issue arises from the Identity Provider IdP server not properly escaping certain characters in a Python exception-message template. This makes it easier for remote attackers to conduct...

The vulnerability of the com.sun.net.ssl component in the Apache CXF web service framework allows a attacker to execute a type of “man-in-the-middle” attack.

The vulnerability of the com.sun.net.ssl component in Apache CXF web services is related to deficiencies in handling exceptional states. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” attack...

Updated xmlrpc packages fix security vulnerability

A flaw was discovered where the XMLRPC client implementation in Apache XMLRPC, performed deserialization of the server-side exception serialized in the faultCause attribute of XMLRPC error response messages. A malicious or compromised XMLRPC server could possibly use this flaw to execute arbitrar...

Debian DSA-4619-1 : libxmlrpc3-java - security update

Guillaume Teissier reported that the XMLRPC client in libxmlrpc3-java, an XML-RPC implementation in Java, does perform deserialization of the server-side exception serialized in the faultCause attribute of XMLRPC error response messages. A malicious XMLRPC server can take advantage of this flaw t...

Invalid Character in Amazon S3 Bucket Name

Challenge When adding/editing an object storage repository and selecting or creating a folder in the Amazon S3 bucket, the following error occurs: Could not establish trust relationship for the SSL/TLS secure channel. Applicable to build 4.0.0.1553. Exception of type...