CVE-2019-13383

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response...

starinux.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-897147 Security Researcher CoderYounes Helped patch 1033 vulnerabilities Received 5 Coordinated Disclosure badges Received 8 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting starinux.org website and...

CVE-2019-10190

A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC validation for non-existence answer. NXDOMAIN answer would get passed through to the client even if its DNSSEC validation failed, instead of...

PT-2019-11613 · Cz.Nic +2 · Knot Resolver +2

Name of the Vulnerable Software and Affected Versions: knot resolver versions prior to 4.1.0 Description: A vulnerability was discovered in the DNS resolver component that allows remote attackers to bypass DNSSEC validation for non-existence answers. Specifically, NXDOMAIN answers would get passe...

libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API

It was discovered that libvirtd would permit read-only clients to use the virDomainSaveImageGetXMLDesc API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of...

SUSE SLED12 / SLES12 Security Update : dnsmasq (SUSE-SU-2019:1721-1)

This update for dnsmasq fixes the following issues : Security issue fixed : CVE-2017-15107: Fixed a vulnerability in DNSSEC implementation. Processing of wildcard synthesized NSEC records may result improper validation for non-existance. bsc1076958 Non-security issue fixed: Reload system dbus to...

GitLab: [information disclosure] Validate existence of a private project.

Summary In Gitlab, we have a feature of creating groups and setting their permissions to public/internal/private. While testing I discovered that a user can check existence of a project in a group of which he is not a part judging by the difference in types of error messages generated. This reque...

CVE-2019-10320

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS12 certificate...

CVE-2019-10320

CVE-2019-10320 affects Jenkins Credentials Plugin (versions ≤ 2.1.18). An authenticated user with credential-management permission could confirm the existence of files on the Jenkins master via an attacker-controlled path, and read PKCS#12 certificate content from those files. This is a file-read...

Adobe Acrobat Pro DC PostScript colorimage Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Foxit Reader and Foxit PhantomPDF for Windows Information Disclosure Vulnerability (CNVD-2019-13823)

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in the resetForm method of Foxit Reader 9.4.1.16828 and earlier, Foxit PhantomPDF 8.3.9.41099 and earlier, and Foxit PhantomPDF 9.4.1.16828 and earlier for Windows...

Foxit Reader and Foxit PhantomPDF Information Disclosure Vulnerability

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in Foxit Reader 9.4.1.16828 and earlier, Foxit PhantomPDF 8.3.9.41099 and earlier, and Foxit PhantomPDF 9.4.1.16828 and earlier for Windows platforms, which originates fro...

Foxit Reader and Foxit PhantomPDF for Windows Information Disclosure Vulnerability (CNVD-2019-13819)

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in the resetForm method of Foxit Reader 9.4.1.16828 and earlier, Foxit PhantomPDF 8.3.9.41099 and earlier, and Foxit PhantomPDF 9.4.1.16828 and earlier for Windows...

SUSE-SU-2018:3776-2 Security update for openssh

This update for openssh fixes the following issues: Following security issues have been fixed: - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not...

Foxit Reader AcroForm removeField Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Foxit Reader AcroForm resetForm Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the resetFo...

The vulnerability of the zfile.c library of the PostScript/PDF Ghostscript interpreter, related to information disclosure, allows attackers to determine the presence and size of arbitrary files.

The vulnerability of the zfile.c library of the PostScript/PDF Ghostscript interpreter is related to the state command, even when the dSAFER sandbox is used. Exploiting this vulnerability allows a remote attacker to determine the presence and size of arbitrary files...

CVE-2019-9649

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique ....\ to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date...

Directory traversal

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique ....\ to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date...

CVE-2019-9648

CVE-2019-9648 affects Core FTP Server FTP/SFTP Server v2 build 674 and earlier. A directory traversal flaw exists in the SIZE command when used with a “....” sequence, allowing an attacker to infer file existence by the server’s response. Public references (Exploit-DB, Metasploit) document this t...