CVE-2019-18835

CVE-2019-18835 affects Matrix Synapse prior to 1.5.0. The root cause is improper signature verification on federation APIs; events sent over /send_join, /send_leave, and /invite may not be correctly signed or may not originate from the expected servers. This can allow spoofing or impersonation of...

CVE-2019-18835

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers...

CVE-2019-18835: Insufficient Verification of Data Authenticity

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers...

PT-2019-15690 · Matrix +2 · Matrix Synapse +2

Name of the Vulnerable Software and Affected Versions: Matrix Synapse versions prior to 1.5.0 Description: The issue concerns the mishandling of signature checking on some federation APIs. Events sent over "/send join", "/send leave", and "/invite" API endpoints may not be correctly signed, or ma...

py-matrix-synapse -- missing signature checks on some federation APIs

Matrix developers report: Make sure that ... events sent over /sendjoin, /sendleave, and /invite, are correctly signed and come from the expected servers...

PT-2019-6377

Name of the Vulnerable Software and Affected Versions Pivotal RabbitMQ versions prior to 3.7.20 Pivotal RabbitMQ version 3.8 prior to 3.8.1 RabbitMQ for PCF versions 1.16.x prior to 1.16.7 RabbitMQ for PCF versions 1.17.x prior to 1.17.4 Description The issue is related to the improper sanitizati...

UBUNTU-CVE-2019-11281

Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user...

CVE-2019-11281: Improper Neutralization of Input During Web Page Generation

Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user...

PT-2019-6097 · Pivotal +2 · Rabbitmq +1

Name of the Vulnerable Software and Affected Versions: Pivotal RabbitMQ versions prior to 3.7.18 RabbitMQ for PCF versions 1.15.x prior to 1.15.13 RabbitMQ for PCF versions 1.16.x prior to 1.16.6 RabbitMQ for PCF versions 1.17.x prior to 1.17.3 Description: The issue is related to incorrect user...

The State of Stalkerware in 2019

Introduction and methodology Six months ago, we created a special alert that notifies users about commercial spyware stalkerware products installed on their phones. This report examines the use of stalkerware and the number of users affected by this software in the first eight months of 2019...

ADFS XSS

The vulnerability of Active Directory Federation Services ADFS on Windows operating systems is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform a cross-site scripting attack by sending a specially crafted request...

CVE-2019-1273

A cross-site-scripting XSS vulnerability exists when Active Directory Federation Services ADFS does not properly sanitize certain error messages, aka 'Active Directory Federation Services XSS Vulnerability'...

CVE-2019-1273

A cross-site-scripting XSS vulnerability exists when Active Directory Federation Services ADFS does not properly sanitize certain error messages, aka 'Active Directory Federation Services XSS Vulnerability'...

CVE-2019-1273

CVE-2019-1273 is an XSS vulnerability in Active Directory Federation Services (ADFS) where error messages are not properly sanitized. The connected documents consistently describe a cross-site scripting issue tied to ADFS error handling, but do not provide specifics on affected product versions, ...

Microsoft Windows Multiple Vulnerabilities (KB4516058)

This host is missing a critical security update according to Microsoft KB4516058 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

CVE-2019-1273: Improper Neutralization of Input During Web Page Generation

A cross-site-scripting XSS vulnerability exists when Active Directory Federation Services ADFS does not properly sanitize certain error messages, aka 'Active Directory Federation Services XSS Vulnerability'...

KLA11552 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, obtain sensitive information, spoof user interface, execute arbitrary code, bypass security restrictions. Below is a complete list of...

platform for automating the

The vulnerability of the platform for automating operations in healthcare institutions of the Russian Federation’s Tra: Pharmaceutical supply is related to deficiencies in the mechanism for limiting the number of authentication attempts. Exploiting this vulnerability could allow a malicious actor...

Tra Platform CSRF Token Missing

The vulnerability of the platform for automating operations in healthcare institutions of the Russian Federation’s Tra: Pharmaceutical Supply relates to the absence of a CSRF token in web forms. Exploiting this vulnerability allows a malicious actor to execute cross-site requests on behalf of...

PT-2019-3309

Name of the Vulnerable Software and Affected Versions Active Directory Federation Services ADFS affected versions not specified Description A cross-site-scripting XSS issue exists due to improper sanitization of certain error messages by Active Directory Federation Services ADFS. This can be...