rubygems: XSS vulnerability in homepage attribute when displayed via gem server

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting XSS vulnerability in gem server display of homepage attribute that can...

PT-2020-15318 · Jenkins · Jenkins Subversion Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Subversion Plugin versions 2.13.0 and earlier Description: The issue is related to a stored cross-site scripting vulnerability. It occurs because the error message for the Project Repository Base URL field form validation is not...

Directive injection when using dynamic overrides with user input

Impact If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in...

PT-2020-1295 · Microsoft +2 · Asp.Net Core +2

Name of the Vulnerable Software and Affected Versions: ASP.NET Core affected versions not specified Description: A denial of service issue exists due to improper handling of web requests by ASP.NET Core. This can be exploited by a remote attacker to cause a denial of service by sending specially...

PT-2019-5512 · Openslp +5 · Openslp +6

Name of the Vulnerable Software and Affected Versions: VMware ESXi and Horizon DaaS affected versions not specified Description: The issue is related to a heap overwrite problem in OpenSLP as used in ESXi and the Horizon DaaS appliances. This can potentially allow a remote attacker to impact the...

PT-2019-6800

Name of the Vulnerable Software and Affected Versions libuser affected versions not specified Description The issue is related to information disclosure when the user's home directory is moved. Recommendations At the moment, there is no information about a newer version that contains a fix for th...

PT-2019-3877

Name of the Vulnerable Software and Affected Versions Windows Servicing Stack affected versions not specified Description The issue is related to an information disclosure problem in the Windows Servicing Stack, which can allow unauthorized access to protected information. This is due to errors i...

PT-2019-6829 · Red Hat · Openshift

Name of the Vulnerable Software and Affected Versions: OpenShift affected versions not specified Description: The issue is related to the improper creation of files in /tmp by the dump.sh script in the cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin directory of OpenShift...

PT-2019-5863 · Imagemagick +5 · Imagemagick +5

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 6.9.10-69 Description: The issue is related to the ApplyEvaluateOperator function in the /MagickCore/statistic.c component of ImageMagick, where a size t cast should have been a ssize t cast. This causes...

Security update for neovim (important)

openSUSE Security Update: Security update for neovim Announcement ID: openSUSE-SU-2019:1997-1 Rating: important References: 1137443 Cross-References: CVE-2019-12735 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This update f...

PT-2019-3003 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Graphics Component affected versions not specified Description: The issue is related to errors in handling objects in memory by the Windows Graphics Component. This can allow an attacker to disclose protected information usi...

Security update for neovim (important)

openSUSE Security Update: Security update for neovim Announcement ID: openSUSE-SU-2019:1796-1 Rating: important References: 1137443 Cross-References: CVE-2019-12735 Affected Products: openSUSE Backports SLE-15 An update that fixes one vulnerability is now available. Description: This update for...

PT-2019-11591 · Red Hat · Osbs-Client

Name of the Vulnerable Software and Affected Versions: osbs-client versions 0.46 through 0.56.0 Description: A flaw was found in the yaml.load function, allowing insecure use that enables loading of suspicious objects for code execution via parsing of malicious YAML files. Recommendations: For...

PT-2019-11749 · Jenkins · Jenkins Port Allocator Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Port Allocator Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted form within job config.xml files on the Jenkins master or controller. These credentials can be accessed...

PT-2019-2723 · Microsoft · Windows Appx Deployment Server +1

Name of the Vulnerable Software and Affected Versions: Windows AppX Deployment Service AppXSVC affected versions not specified Description: The issue is related to the improper handling of hard links by the Windows AppX Deployment Service AppXSVC, which can lead to an elevation of privilege. This...

PT-2019-2568 · Abb · Abb Idal Ftp Server

Name of the Vulnerable Software and Affected Versions: ABB IDAL FTP server affected versions not specified Description: The issue is related to the mishandling of format strings in a username during the authentication process. Attempting to authenticate with the username %s%p%x%d will crash the...

CVE-2019-11880

CommSy through 8.6.5 has SQL Injection via the cid parameter. This is fixed in 9.2...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read. An issue was discovered in libSDL2.a in Simple DirectMedia Layer SDL 2.0.9 when used in conjunction with libSDL2image.a in SDL2image 2.0.4. There is an out-of-bounds read in the SDL function SDLFreePaletteREAL at...

PT-2019-11684 · Jenkins · Jenkins Klaros-Testmanagement Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Klaros-Testmanagement Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within job config.xml files on the Jenkins master or controller. These credentials can be...

PT-2019-11360 · Jenkins · Veracode Scan Jenkins Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins veracode-scanner Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file of the Jenkins veracode-scanner Plugin, specifically in t...