CVE-2018-17944

CVE-2018-17944 affects certain Lexmark devices that communicate with LDAP or SMTP servers. The vulnerability occurs because stored credentials are not automatically deleted when the server hostname is changed to one controlled by an attacker, allowing the attacker to capture LDAP/SMTP credentials...

CVE-2018-17944

On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one that they control, and then capturing the credentials that are sent there. This occurs because stored credentials are...

dotCMS Open Redirect Vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A security vulnerability exists in dotCMS versions prior to 5.0.2. An attacker can exploit this vulnerability to...

CVE-2018-17422

dotCMS before 5.0.2 has open redirects via the html/common/forwardjs.jsp FORWARDURL parameter or the html/portlet/ext/common/pagepreviewpopup.jsp hostname parameter...

openSUSE: Security Advisory for nodejs6 (openSUSE-SU-2019:0234-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2019:0395-1)

This update for nodejs6 to version 6.16.0 fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation bsc1113652 CVE-2018-5407: Fixed a hyperthread port content side channel attack aka 'PortSmash' bsc1113534 CVE-2018-12120: Fixe...

SUSE-SU-2019:0395-1 Security update for nodejs6

This update for nodejs6 to version 6.16.0 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation bsc1113652 - CVE-2018-5407: Fixed a hyperthread port content side channel attack aka 'PortSmash' bsc1113534 - CVE-2018-12120:...

Hontel - Telnet Honeypot

HonTel is a Honeypot for Telnet service. Basically, it is a Python v2.x application emulating the service inside the chroot environment. Originally it has been designed to be run inside the Ubuntu environment, though it could be easily adapted to run inside any Linux environment. Documentation:...

The vulnerability of the get_cookies function in the HTTP library libsoup, which allows a hacker to execute arbitrary code.

The vulnerability of the getcookies function in the HTTP library libsoup is related to errors in input processing. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a null hostname...

The vulnerability of the Apache ActiveMQ messaging broker, related to the lack of TLS hostname verification, allows attackers to gain unauthorized access to protected data.

The vulnerability of the Apache ActiveMQ messaging broker is related to the absence of hostname verification for TLS. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected data...

openSUSE Security Update : nodejs8 (openSUSE-2019-89)

This update for nodejs8 to version 8.15.0 fixes the following issues : Security issues fixed : - CVE-2018-12121: Fixed a Denial of Service with large HTTP headers bsc1117626 - CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of Service bsc1117627 - CVE-2018-12116: Fixed HTTP request splitting...

Security update for nodejs4 (important)

openSUSE Security Update: Security update for nodejs4 Announcement ID: openSUSE-SU-2019:0088-1 Rating: important References: 1113534 1113652 1117625 1117626 1117627 1117629 1117630 Cross-References: CVE-2018-0734 CVE-2018-12116 CVE-2018-12120 CVE-2018-12121 CVE-2018-12122 CVE-2018-12123...

tomcat: Host name verification missing in WebSocket client

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88...

SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2019:0118-1)

This update for nodejs8 to version 8.15.0 fixes the following issues : Security issues fixed : CVE-2018-12121: Fixed a Denial of Service with large HTTP headers bsc1117626 CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of Service bsc1117627 CVE-2018-12116: Fixed HTTP request splitting bsc11176...

SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2019:0117-1)

This update for nodejs4 fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation bsc1113652 CVE-2018-5407: Fixed a hyperthread port content side channel attack aka 'PortSmash' bsc1113534 CVE-2018-12120: Fixed that the debugge...

SUSE-SU-2019:0118-1 Security update for nodejs8

This update for nodejs8 to version 8.15.0 fixes the following issues: Security issues fixed: - CVE-2018-12121: Fixed a Denial of Service with large HTTP headers bsc1117626 - CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of Service bsc1117627 - CVE-2018-12116: Fixed HTTP request splitting...

SUSE-SU-2019:0117-1 Security update for nodejs4

This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation bsc1113652 - CVE-2018-5407: Fixed a hyperthread port content side channel attack aka 'PortSmash' bsc1113534 - CVE-2018-12120: Fixed that the...

Cacti cross-site scripting vulnerability (CNVD-2019-14552)

Cacti is an open source, web-based network monitoring and mapping tool, a front-end application designed for the data logging tool RRDtool. A cross-site scripting vulnerability exists in the 'Website Hostnam' field of the pollers.php file in versions of Cacti prior to 1.2.0, which stems from the...

Cacti cross-site scripting vulnerability (CNVD-2019-14553)

Cacti is an open source, web-based network monitoring and mapping tool, a front-end application designed for the data logging tool RRDtool. A cross-site scripting vulnerability exists in the 'Website Hostname' parameter of the host.php file in versions of Cacti prior to 1.2.0, which stems from th...

CVE-2018-20726

A cross-site scripting XSS vulnerability exists in host.php via tree.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices...