Mozilla: Thunderbird stored OpenPGP secret keys without master password protection

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...

Vulnerabilities fixed in XWiki

Vulnerabilities have been fixed in XWiki. The vulnerabilities allow an authenticated malicious person to execute scripts without having the necessary permissions to do so. In addition, a malicious person with inactive account could bypass a security measure that allows access to the account to be...

Wire 信息泄露漏洞

Wire is a chat software by an individual developer. The software supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original greeting method, PING. Wire suffers from a security vulnerability that stems from the fact that when a us...

The vulnerability of ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security, ESET Smart Security Premium, ESET Endpoint Antivirus, ESET Endpoint Security, ESET NOD32 Antivirus Business Edition, ESET Smart Security Business Edition, ESET File Security for Microsoft Windows Server, ESET Mail Security for Microsoft Exchange Server, ESET Mail Security for IBM Domino, ESET Security for Kerio, and ESET Security for Microsoft SharePoint Server lies in a lack of standard permission mechanisms, allowing attackers to re-record arbitrary files.

The vulnerability of ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security, ESET Smart Security Premium, ESET Endpoint Antivirus, ESET Endpoint Security, ESET NOD32 Antivirus Business Edition, ESET Smart Security Business Edition, ESET File Security for Microsoft Windows Server, ESET...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.0: Add Allow-/Block-List for Migrate and Mirrors Prevent git operations for inactive users Disallow urlencoded new lines in git protocol paths if there is a port Mitigate Security vulnerability in the git hook feature Disable DSA ssh keys by default Set TLS...

FreeBSD : gitea -- multiple vulnerabilities (55facdb0-2c24-11eb-9aac-08002734b9ed)

The Gitea Team reports for release 1.12.6 : - Prevent git operations for inactive users - Disallow urlencoded new lines in git protocol paths if there is a port C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

RosarioSIS Cross-Site Scripting Vulnerability

RosarioSIS is a student information system for school management. A cross-site scripting vulnerability exists in RosarioSIS 6.7.2. The vulnerability stems from improper validation of user-supplied input in the PrintSchedules.php script. A remote attacker can exploit the vulnerability by using the...

CVE-2019-14883

A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token...

CVE-2019-14883

A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token...

CVE-2019-14883

CVE-2019-14883 affects Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3. The vulnerability arises because tokens used to fetch inline attachments in email notifications were not disabled when a user’s account became inactive. The attacker would need to know the file path and a valid token to access t...

Product release: Virtuozzo Infrastructure Platform 3.5 Update 1 (3.5.1-43)

This update provides a new feature as well as fixes and improvements. Vulnerability id: VSTOR-30003 Unable to release node from cluster: 'Unable to send message to any node in ABGW cluster'. Vulnerability id: VSTOR-30135 No read/write data on dashboards if multipath is configured. Vulnerability i...

VMware Carbon Black Cloud Endpoint Standard Inactive

Binary data vmwarecarbonblackcloudendpointstandardwinstatus.nbin...

CVE-2019-13347

An issue was discovered in the SAML Single Sign On SSO plugin for several Atlassian products affecting versions 3.1.0 through 3.2.2 for Jira and Confluence, versions 2.4.0 through 3.0.3 for Bitbucket, and versions 2.4.0 through 2.5.2 for Bamboo. It allows locally disabled users to reactivate thei...

The vulnerability of the fly-admin-dm graphic input component in the FLY operating system environment of Astra Linux, related to a resource management error, allows attackers to trigger a service failure.

The vulnerability of the fly-admin-dm graphic input component in the FLY operating environment of the Astra Linux system is related to inactive restart options. Exploiting this vulnerability allows a remote attacker to cause service failure...

The vulnerability of the vGate virtualization platform’s security mechanism, which allows intruders to bypass existing security measures

The vulnerability of the vGate virtualization platform’s security mechanism lies in the fact that authentication is performed against rules that are not currently in effect for vGate i.e., outside the protected perimeter. There is also a lack of control over user authentication processes within...

CVE-2019-13147

In Audio File Library aka audiofile 0.3.6, there exists one NULL pointer dereference bug in ulaw2linearbuf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file...

UBUNTU-CVE-2016-1584

In all versions of Unity8 a running but not active application on a large-screen device could talk with Maliit and consume keyboard input...

Report Vulnerabilities in inactive Linux Kernel(s)

This script reports vulnerabilities found via package manager based Local Security Checks in installed but inactive Linux Kernels with a lower severity. This functionality needs to be separately enabled with the setting Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be...

django: Information leakage in AuthenticationForm

django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirmloginallowed method, as demonstrated by discovering whether a user account is inactive...

GHSA-RF4J-J272-FJ86 Django vulnerable to information leakage in AuthenticationForm

django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirmloginallowed method, as demonstrated by discovering whether a user account is inactive...