PT-2019-8342

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 67.9999.103 Description The issue concerns the lack of SSL hostname verification for the support-agreement download. Recommendations For versions prior to 67.9999.103, update to version 67.9999.103 or later to resolve...

CVE-2017-18407: Improper Verification of Cryptographic Signature

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download SEC-279...

python27:2.7 bug fix update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Bug Fixes:...

python3 bug fix update

An update is available for python3. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Bug Fixes: urlsplit doesn't accept a NFKD hostname with a port number BZ17147...

PT-2019-1004

Name of the Vulnerable Software and Affected Versions: Python affected versions not specified Description: The issue is related to the urlsplit function not accepting a NFKD hostname with a port number. Recommendations: At the moment, there is no information about a newer version that contains a...

CVE-2018-13897: Exposure of Sensitive Information to an Unauthorized Actor

Clients hostname gets added to DNS record on device which is running dnsmasq resulting in an information exposure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9640,...

PT-2019-8988

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660,...

nodejs: Hostname spoofing in URL parser for javascript protocol

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" e.g. "javAscript:" protoc...

CVE-2018-20852

Removed by vendor...

CVE-2019-13280

TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an error message to the user about failure to resolve a hostname during a ping or traceroute attempt. This allows an authenticated user to execute arbitrary code. The exploit can b...

Fedora 30 : libvirt (2019-b2dfb13daf)

CVE-2019-10161: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API bz 1722463, bz 1720115 - CVE-2019-10166: virDomainManagedSaveDefineXML API exposed to readonly clients bz 1722462, bz 1720114 - CVE-2019-10167: arbitrary command execution via virConnectGetDomainCapabilities API bz...

WordPress Server Status by Hostname/IP plugin SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Server Status by Hostname/IP plugin is used in one of the server monitoring plugin. A SQL injection vulnerability exists in version 4.6...

PT-2019-12860

Name of the Vulnerable Software and Affected Versions Xpert Solution "Server Status by Hostname/IP" plugin version 4.6 Description A SQL injection issue allows an authenticated user to execute arbitrary SQL commands via GET parameters. Recommendations For Xpert Solution "Server Status by...

CVE-2019-12570: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQL commands via GET parameters...

CVE-2017-8411

CVE-2017-8411 affects D-Link DCS-1130 devices. A command-injection path exists via a POST parameter that can be processed by a vulnerable system API, enabling execution of arbitrary commands. Investigations point to libmailutils.so, where a vulnerable function sub_1FC4 receives POST data; the val...

Hostname-based Context Keyed Payload Encoder

Context-Keyed Payload Encoder based on hostname and x64 XOR encoder. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Hostname-based Context Keyed Payload Encoder', 'Description' = 'Context-Keye...

Server Status by Hostname/IP <= 4.6 - Authenticated SQL Injection

The last time it was checked the plugin was still affected and had been closed. PoC http://www.example.com/wp-admin/admin.php?page=all-servers=2+UNION+SELECT+1%2C2%2C3%2C%40%40version+=edit...

PT-2019-20110

Name of the Vulnerable Software and Affected Versions Python versions 3.7 and newer Description The issue arises from the inet aton function accepting trailing characters after a valid IP, which can lead to incorrect validation of hostnames and IP addresses in certificates. This can potentially...

PSF-2019-13 ssl.match_hostname() ignores extra string after whitespace in IPv4 address

inetaton accepts trailing characters after a valid IP. Because of that, Python ssl.matchhostname'1.1.1.1 ; this should not work but does' succeeded when it should fail. The issue was introduced in bpo-32819 by commit aef1283b . Only Python 3.7 and newer are affected. It's a potential security bug...

Samsung Galaxy Apps Trust Management Issue Vulnerability

Samsung Galaxy Apps is a pre-installed application store program for Samsung mobile devices from Samsung South Korea. A security vulnerability exists in Samsung Galaxy Apps versions prior to 4.4.01.7. An attacker can exploit the vulnerability to modify the hostname to mimic the app store's API,...