GHSA-WP7M-MRVF-599C Command Injection in node-df

All versions of node-df are vulnerable to Command Injection. The package fails to sanitize filenames passed to the file option. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. Recommendation No fix is currently available. Consider using an...

PT-2020-9722 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.2.2 and earlier Description: The issue allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. Recommendations: For GitLab versions 12.2.2 and earlier, update t...

PT-2020-1604 · Microsoft · Windows Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Installer affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in the Windows Installer when processing symbolic links. This can be exploited by an attacker to elevate their...

PT-2020-1684 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: The issue is related to a cross-site scripting XSS vulnerability. This occurs when Microsoft SharePoint Server fails to properly sanitize a specially crafted web request...

Security Advisory - Improper Authorization Vulnerability in Several Smartphones

There is an improper authorization vulnerability in several smartphones. The system has a logic judging error under certain scenario, successful exploit could allow the attacker to switch to third desktop after a series of operation in ADB mode. Vulnerability ID: HWPSIRT-2019-10114 This...

PT-2020-1325

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 on-premises affected versions not specified Description A cross-site scripting issue exists due to improper sanitization of specially crafted web requests to the affected Dynamics server. This could allow a remote attack...

PT-2020-9549 · Ricoh · Ricoh Sp C250Dn

Name of the Vulnerable Software and Affected Versions: Ricoh SP C250DN version 1.06 Description: The issue is related to Incorrect Access Control. Recommendations: For version 1.06, at the moment, there is no information about a newer version that contains a fix for this issue...

Security Bulletin: IBM QRadar SIEM uses weak credential storage in some instances (CVE-2019-4508)

Summary IBM QRadar SIEM uses weak credential storage in some instances Vulnerability Details CVEID: CVE-2019-4508 DESCRIPTION: IBM QRadar SIEM uses weak credential storage in some instances which could be decrypted by a local attacker. CVSS Base score: 5.1 CVSS Temporal Score: See:...

PT-2020-1371 · Cisco · Cisco Data Center Network Manager

Name of the Vulnerable Software and Affected Versions: Cisco Data Center Network Manager DCNM affected versions not specified Description: The issue arises due to the failure to neutralize special elements used in the operating system command. This could allow a remote attacker to execute arbitra...

PT-2019-6139 · Tvt · Tvt Nvms-1000

Name of the Vulnerable Software and Affected Versions: TVT NVMS-1000 affected versions not specified Description: The issue is related to directory traversal in TVT NVMS-1000 devices, allowing unauthorized access to restricted information. This is due to incorrect limitation of the path name to a...

PT-2019-16108 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: GPAC versions 0.8.0 through 0.9.0-development-20191109 Description: An issue was discovered in the function gf odf avc cfg write bs in odf/descriptors.c, which leads to a NULL pointer dereference. Recommendations: For GPAC version 0.8.0, ther...

PT-2019-16058 · Libsixel +1 · Libsixel +1

Name of the Vulnerable Software and Affected Versions: libsixel version 1.8.4 Description: A memory leak was discovered in the image buffer resize function in fromsixel.c in libsixel. Recommendations: For libsixel version 1.8.4, at the moment, there is no information about a newer version that...

PT-2019-19182 · Apple · Itunes

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A denial of service issue exists due to inadequate input validation, allowing attackers to cause a denial of service. Recommendations: At the moment, there is no information about a...

Security Bulletin: IBM API Connect is potentially impacted by weak cryptographic algorithms(CVE-2019-4609)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4609 DESCRIPTION: IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base score: 5.9 CVSS Temporal...

PT-2019-14730 · Jenkins · Jenkins Alauda Kubernetes Support Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Alauda Kubernetes Support Plugin versions 2.3.0 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing the...

PT-2019-15895 · Libsixel +1 · Libsixel +1

Name of the Vulnerable Software and Affected Versions: libsixel version 1.8.2 Description: An issue was discovered in the function sixel encode body at tosixel.c, which is affected by an integer overflow. Recommendations: For libsixel version 1.8.2, at the moment, there is no information about a...

PT-2019-6279 · Fortinet · Fortimanager +2

Name of the Vulnerable Software and Affected Versions: FortiOS, FortiManager, and FortiAnalyzer affected versions not specified Description: The vulnerability involves the use of a hard-coded cryptographic key to encrypt sensitive data within configuration backup files and CLI configurations. An...

Security Bulletin: IBM Security Guardium is affected by an OpenSSH vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by different responses to valid and invalid authentication attempts. By sending a special...

PT-2019-3861

Name of the Vulnerable Software and Affected Versions Internet Explorer affected versions not specified Description A remote code execution issue exists due to errors in handling objects in memory. This could allow a remote attacker to execute arbitrary code in the context of the current user or...

PT-2019-3956

Name of the Vulnerable Software and Affected Versions Windows TCP/IP affected versions not specified Description The issue is related to an information disclosure problem in the Windows TCP/IP stack, specifically with how it handles IPv6 flowlabel filled packets. This could allow a remote attacke...