5770 matches found
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
Impact The patches introduced to fix https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 were not complete and still would allow an attacker to smuggle requests/split a HTTP request with invalid data. This updates the existing CVE with ID: CVE-2019-16789 Patches Waitress...
[SECURITY] [DLA 1931-2] libgcrypt20 regression update
Package : libgcrypt20 Version : 1.6.3-2+deb8u8 CVE ID : CVE-2019-13627 It was discovered that the fix to address an ECDSA timing attack in the libgcrypt20 cryptographic library was incomplete. For Debian 8 "Jessie", this issue has been fixed in libgcrypt20 version 1.6.3-2+deb8u8. Thanks to Albert...
CVE-2015-5592
Incomplete blacklist in sanitizestring in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting XSS attacks...
Cross site scripting
Incomplete blacklist in sanitizestring in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting XSS attacks...
CVE-2015-5592
Zenphoto is affected by CVE-2015-5592 due to an incomplete blacklist in sanitize_string prior to version 1.4.9, enabling remote attackers to conduct cross-site scripting (XSS). The vulnerability affects Zenphoto 1.4.x before 1.4.9. The root cause is improper input validation in the sanitize_strin...
CVE-2013-2011
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009...
CVE-2013-2011
WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009...
CVE-2019-19926
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880...
DEBIAN-CVE-2019-19926
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880...
Code injection
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880...
EulerOS 2.0 SP3 : foomatic (EulerOS-SA-2019-2579)
According to the versions of the foomatic packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x...
CVE-2019-19880
exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled...
Important: Red Hat Security Advisory: kpatch-patch security update
An update for kpatch-patch is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
UBUNTU-CVE-2019-5062
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial...
CVE-2013-7371
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware vulnerability due to incomplete fix for CVE-2013-7370...
Cross site scripting
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware vulnerability due to incomplete fix for CVE-2013-7370...
UBUNTU-CVE-2013-7371
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware vulnerability due to incomplete fix for CVE-2013-7370...
CVE-2013-7371
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware vulnerability due to incomplete fix for CVE-2013-7370...