KLA11679 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code. Below is a complete list of vulnerabilities: 1. HTTP request smuggling vulnerability can be exploited remotely to obtain sensitive...

CVE-2019-7481

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier...

CVE-2018-1002102 Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificat...

CVE-2019-18658

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service DoS via a special file such as /dev/urandom, via...

Design/Logic Flaw

The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D18...

GitLab Information Disclosure Vulnerability (CNVD-2019-30784)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

F5 Networks BIG-IP : F5 tmsh vulnerability (K40378764)

"Authenticated users with the ability to upload files via scp, for example can escalate their privileges to allow root shell access from within the TMOS Shell tmsh interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp . CVE-2019-6642 Impact...

VMSA-2019-0010:VMware product updates address Linux kernel vulnerabilities in TCP Selective Acknowledgement (SACK)

VMware Security Advisories Advisory ID| VMSA-2019-0010.3 ---|--- Advisory Severity| Important CVSSv3 Range| 5.3 - 7.5 Synopsis| VMware product updates address Linux kernel vulnerabilities in TCP Selective Acknowledgement SACK CVE-2019-11477, CVE-2019-11478 Issue Date| 2019-07-02 Updated On|...

JVN#43172719: Multiple vulnerabilities in Hikari Denwa router/Home GateWay

Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION and NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2019-5985 Version| Vector| Score ---|---|--- CVSS v3|...

7ghost (>=4.11.0 <=4.11.46), @agneta/platform (>=0.16.9 <=0.17.0) +75 more potentially affected by unknown CVE via express-brute (>=0.4.2 <=1.0.1)

express-brute NPM version =0.4.2, =4.11.0, =0.16.9, =0.0.2, =3.1.0, =0.0.1, =0.0.2, =1.0.0-0, =1.3.3, =1.0.0, =1.1.0, =3.41.6, =1.0.1, =3.0.16-soul - @nadyashakhat/ghost =4.17.1 - @patrick91/ghost =5.2.3-patrick.1 - @phacce/ms-app =0.1.0 and more Source cves: unknown CVE Source advisory:...

CVE-2018-12126

Microarchitectural Store Buffer Data Sampling MSBDS: Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here:...

CVE-2018-12126

Microarchitectural Store Buffer Data Sampling MSBDS: Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here:...

entweet (=2.0.0), irrd (=4.0.0rc1) +1 more potentially affected by CVE-2019-6690 via python-gnupg (>=0.3.9 <=0.4.3)

python-gnupg PYPI version =0.3.9, =0.16.8, =0.21.0 Source cves: CVE-2019-6690 Source advisory: OSV:GHSA-2FCH-JVG5-CRF6...

F5 Networks BIG-IP : BIND vulnerability (K00040234)

A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 - 9.10.8-P1, 9.11.3 - 9.11.5-P1, 9.12.0 - 9.12.3-P1, and versions 9.10.7-S1 - 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 - 9.13.6 of th...

Microsoft Office Word Viewer Security Feature Bypass Vulnerability (KB4462154)

This host is missing an important security update according to Microsoft KB4462154 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

08cms (=1.0.0), 1-of (>=1.0.0 <=1.0.1) +4827 more potentially affected by CVE-2018-16492 via extend (>=1.1.3 <=2.0.1)

extend NPM version =1.1.3, =1.0.0, =0.7.0, =0.1.0, =0.0.2, =0.0.1, =0.0.0, =0.1.4, =1.16.0, =0.0.1, =0.0.5 and more Source cves: CVE-2018-16492 Source advisory: OSV:GHSA-QRMC-FJ45-QFC2...

org.apache.syncope:syncope-core-upgrader (>=1.2.0 <=1.2.10), org.apache.syncope:syncope-standalone (>=1.1.0 <=1.1.8) potentially affected by CVE-2018-1321 via org.apache.syncope:syncope-core (>=1.1.0 <=1.2.10)

org.apache.syncope:syncope-core MAVEN version =1.1.0, =1.2.0, =1.1.0, =1.1.8 Source cves: CVE-2018-1321 Source advisory: OSV:GHSA-XGC9-9W4V-H33H...

003-gas-convert (=1.0.1), 01homework (>=1.0.0 <=1.0.1) +49192 more potentially affected by CVE-2014-9772 via validator (>=0.1.8 <=1.5.1)

validator NPM version =0.1.8, =1.0.0, =0.0.2, =0.0.8, =0.0.1, =0.0.6, =1.0.9, =0.0.1, =0.0.122 and more Source cves: CVE-2014-9772 Source advisory: OSV:GHSA-79MX-88W7-8F7Q...

ch.digitalfondue.stampo:ch.digitalfondue.stampo.gradle.plugin (=0.0.3), ch.digitalfondue.stampo:stampo (>=1.0 <=1.2.1) +837 more potentially affected by CVE-2017-2670 via io.undertow:undertow-core (>=1.0.0.Alpha1 <=1.3.27.Final)

io.undertow:undertow-core MAVEN version =1.0.0.Alpha1, =1.0, =1.0, =0.1.0, =0.2.0, =1.1.11, =1.1.11, =1.1.16, =1.1.0, =0.0.8, =0.0.8, =0.1.0, =0.0.6, =0.1.3 and more Source cves: CVE-2017-2670 Source advisory: OSV:GHSA-3X7H-5HFR-HVJM...

cc.voox:publisher (>=0.1.0.Beta <=2.2.0), cloud.altemista.fwk.integration:cloud-altemistafwk-core-integration-amqp-conf (>=3.0.0.RELEASE <=3.0.1.RELEASE) +130 more potentially affected by CVE-2018-11087 via org.springframework.amqp:spring-amqp (>=2.0.0.RELEASE <=2.0.5.RELEASE)

org.springframework.amqp:spring-amqp MAVEN version =2.0.0.RELEASE, =0.1.0.Beta, =3.0.0.RELEASE, =3.0.0.RELEASE, =B.0.0.1, =B.0.0.1, =0.1.0-RC1, =1.0.0, =1.0.0, =1.0.0.20191020.beta, =1.0.0.20210917f.beta and more Source cves: CVE-2018-11087 Source advisory: OSV:GHSA-W4G2-9HJ6-5472...