CVE-2020-9402

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escapi...

CVE-2020-9402

A SQL-injection flaw was found in python-django, where GIS functions and aggregates in Oracle did not correctly neutralize tolerance-parameter data. A remote attacker could use this flaw to submit crafted data to inject malicious SQL. Mitigation There is no known mitigation for this issue, the fl...

CVE-2019-3404

By adding some special fields to the uri ofrouter app function, the user could abuse background app cgi functions withoutauthentication. This affects 360 router P0 and F5C...

Design/Logic Flaw

By adding some special fields to the uri ofrouter app function, the user could abuse background app cgi functions withoutauthentication. This affects 360 router P0 and F5C...

CVE-2019-3404

By adding some special fields to the uri ofrouter app function, the user could abuse background app cgi functions withoutauthentication. This affects 360 router P0 and F5C...

CVE-2019-3404

The CVE-2019-3404 issue affects 360 router P0 and F5C, where adding special fields to the URI of a router app function can allow a user to abuse background CGI functions without authentication. Root cause is a URI-level manipulation vulnerability in the router’s app function; impact is unauthoriz...

USN-4296-1: Django vulnerability

Norbert Szetei discovered that Django incorrectly handled the GIS functions and aggregates on Oracle. A remote attacker could possibly use this issue to perform an SQL injection attack...

UBUNTU-CVE-2020-9402

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escapi...

Vulnerability of the functions g_file_make_directory_with_parents and g_file_replace_contents in the Glib library, which allows attackers to escalate their privileges and gain access to files.

The vulnerability of the gfilemakedirectorywithparents and gfilereplacecontents functions in the Glib library is related to improper handling of permissions. Exploiting this vulnerability can allow an attacker to enhance their privileges and gain access to files...

The vulnerability of the lib/functions.php component in the Cacti network monitoring software allows a attacker to compromise data integrity or cause service failures.

The vulnerability of the lib/functions.php component of the Cacti network monitoring software is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to compromise data integrity or cause service failures...

OPENSUSE-SU-2020:0286-1 Security update for ppp

This update for ppp fixes the following security issue: - CVE-2020-8597: Fixed a buffer overflow in the eaprequest and eapresponse functions bsc1162610. This update was imported from the SUSE:SLE-15:Update update project...

SUSE-SU-2020:0555-1 Security update for python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer

This update for python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer, python-jsonpatch, python-jsonpointer, python-scandir, python-PyYAML fixes the...

CVE-2019-10805

valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function hasOwnProperty from the unsafe user-input to examine an object. It is possible for a crafted payload to overwri...

Security feature bypass

valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function hasOwnProperty from the unsafe user-input to examine an object. It is possible for a crafted payload to overwri...

CVE-2019-10805

The CVE-2019-10805 issue affects the valib library (up to version 2.0.0) where a crafted payload can overwrite hasOwnProperty and bypass inspection functions, enabling Internal Property Tampering and bypass of security checks. Multiple connected advisories (RH, ENISA EUVD, OSV, Veracode, Snyk) co...

CVE-2019-10064

hostapd before 2.6, in EAP mode, makes calls to the rand and random standard library functions without any preceding srand or srandom call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743...

CVE-2019-10064

hostapd before 2.6, in EAP mode, makes calls to the rand and random standard library functions without any preceding srand or srandom call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743...

PHP 7.2.x < 7.2.28 / PHP 7.3.x < 7.3.15 / 7.4.x < 7.4.3 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is either 7.2.x prior to 7.2.28, 7.3.x prior to 7.3.15, or 7.4.x prior to 7.4.3. It is, therefore, affected by multiple vulnerabilities: - A heap-based buffer overflow condition exists in pharextractfile function due to...

Django -- potential SQL injection vulnerability

MITRE CVE reports: Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was...

Ultimate Membership Pro < 8.6.2 - Multiple CSRF Issues via AJAX Calls, Insufficient Filename Entropy

Version 8.6.1 attempted fo fix multiple critical issues mainly lack of authorisation checks, allowing low privileges users to call the admin functions of the plugin, leading to PII disclosure and login bypasses. However, the fixes were not sufficient: - An indeedIsAdmin check was added to all AJA...