Stripo Inc: [www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header.

Summary In https://stripo.email/template-order I think you have implemented rate limiting via 429 status code for too many requests, but in reality it is not. An attacker could bypass the 429 speed limit by adding an X-Forwarded-For header. Steps To Reproduce 1. Go to the...

Photon OS 3.0: Libtasn1 PHSA-2020-3.0-0081

An update of the libtasn1 package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0081. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid135777;...

Photon OS 3.0: Httpd PHSA-2020-3.0-0079

An update of the httpd package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0079. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid135787...

DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Security Configurability - The user can using the same password as your current ID.

The current username and password can be set the same, making it easy to guess the password. As a weak password policy issue, The current username and password can be set the same, making it easy to guess the password. |Technical severity|VRT category| Specific vulnerability name|Variant / Affect...

DedeCMS 7.5 SP2 Persistent Cross Site Scripting

Document Title: =============== DedeCMS v7.5 SP2 - Multiple Persistent Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2195 Release Date: ============= 2020-04-09 Vulnerability Laboratory ID VL-ID: ===================================...

Photon OS 1.0: Openvswitch PHSA-2020-1.0-0288

An update of the openvswitch package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0288. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

DedeCMS 7.5 SP2 - Persistent Cross-Site Scripting

Title: DedeCMS 7.5 SP2 - Persistent Cross-Site Scripting Author: Vulnerability Laboratory Date: 2020-04-15 Vendor Link: http://www.dedecms.com Software Link: http://www.dedecms.com/products/dedecms/downloads/ CVE: N/A Document Title: =============== DedeCMS v7.5 SP2 - Multiple Persistent Web...

DedeCMS 7.5 SP2 Cross Site Scripting

Document Title: =============== DedeCMS v7.5 SP2 - Multiple Cross Site Scripting Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2194 Release Date: ============= 2020-04-08 Vulnerability Laboratory ID VL-ID:...

Solaris 10 (sparc) : 125279-09

CDE 1.6: dtsession patch. Date this patch was last updated by Sun : Apr/13/20 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'compat.inc'; if description scriptid135435; scriptversion"1.5";...

Solaris 10 (x86) : 142530-02

SunOS 5.10x86: uptime w utmpupdate whodo patch. Date this patch was last updated by Sun : Apr/13/20 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid135442; scriptversion"1.3";...

Solaris 10 (sparc) : 142529-02

SunOS 5.10: uptime w utmpupdate whodo patch. Date this patch was last updated by Sun : Apr/13/20 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid135436; scriptversion"1.3";...

inc-conso.fr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1139413 Security Researcher kun-fly Helped patch 668 vulnerabilities Received 7 Coordinated Disclosure badges Received 43 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting inc-conso.fr website and it...

Stripo Inc: SSRF via Export Service in ActiveCampaign

SSRF with ActiveCampaign...

Symantec Data Center Security Manager Privilege Escalation

Symantec Data Center Security Manager Component, with versions earlier than 6.8.2 aka 6.8 MP2, are found to be susceptible to a privilege escalation vulnerability, where an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected...

Fedora 31 : rubygem-puma (2020-fd87f90634)

Security fix for CVE-2020-5247, CVE-2020-5249 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...

libreoffice security and bug fix update

1:5.3.6.1-24.0.1 - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile - Build with --with-vendor='Oracle America, Inc.' 1:5.3.6.1-24 - Resolves: rhbz1728763 bg of blocks is black 1:5.3.6.1-23 - Resolves: rhbz1601372 libreoffice fails to build with...

SUSE SLED15 / SLES15 Security Update : bluez (SUSE-SU-2020:0918-1)

This update for bluez fixes the following issues : CVE-2020-0556: Fixed an improper access control which could have allowed an unauthenticated user to potentially enable escalation of privilege and denial of service bsc1166751. Note that Tenable Network Security has extracted the preceding...

RHEL 7 : systemd (RHSA-2020:1264)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1264 advisory. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides...

Design/Logic Flaw

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to...

CVE-2019-2391 JS-bson may incorrectly serialise some requests

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to...