Security Bulletin: Log Analysis is vulnerable to Injection Attacks

Summary Operating system commands can be included in user input as parameters and be executed on the system which lead to injection attacks. Vulnerability Details Third Party Entry: PSIRT-ADV0018499 DESCRIPTION: Created from Advisory: ADV0018499 CVSS Base score: 8.4 CVSS Vector:...

CVE-2019-12416

we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default...

CVE-2019-12416

we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default...

Design/Logic Flaw

we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default...

CVE-2019-12416

we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default...

CVE-2019-12416

CVE-2019-12416 concerns two reported injection attacks against DeltaSpike’s windowhandler.js, active only when the ClientSideWindowStrategy is explicitly selected (not the default). The connected Red Hat and OSV/GHSA entries repeat this description and confirm the issue is tied to DeltaSpike, wit...

CVE-2020-5249

In Puma RubyGem before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is...

Ubuntu 18.04 LTS : Django vulnerability (USN-4264-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4264-1 advisory. Simon Charette discovered that Django incorrectly handled input in the PostgreSQL module. A remote attacker could possibly use this to perform SQL injection...

Critical Flaws in Magento e-Commerce Platform Allow Code-Execution

Critical vulnerabilities in Adobe’s Magento e-commerce platform – a favorite target of the Magecart cybergang – could lead to arbitrary code execution. Adobe issued patches on Tuesday as part of its overall release of the Magento 2.3.4 upgrade, giving the fixes a “priority 2” rating. In Adobe...

PSF-2019-16 Email header injection in Address objects

It is possible to inject email headers using CR or LF character. The fix disallows CR and LF characters in email.headerregistry.Address arguments to guard against header injection attacks...

Design/Logic Flaw

An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, they are prone to keystroke injection attacks...

Firefox Blocks Inline and Eval JavaScript on Internal Pages to Prevent Injection Attacks

In an effort to mitigate a large class of potential cross-site scripting issues in Firefox, Mozilla has blocked execution of all inline scripts and potentially dangerous eval-like functions for built-in "about: pages" that are the gateway to sensitive preferences, settings, and statics of the...

USN-4127-1: Python vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only...

Golang Go CVE-2019-16276 HTTP Request Smuggling Vulnerability

Description Golang Go is prone to an HTTP-request-smuggling vulnerability. A remote attacker may leverage this issue to poison web caches,bypass security defenses, launch cross-site scripting and HTML-injection attacks, and execute session-hijacking attacks. Other attacks are also possible...

Ubuntu 16.04 LTS / 18.04 LTS : Python vulnerabilities (USN-4127-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4127-1 advisory. It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading ...

Pown-Duct - Essential Tool For Finding Blind Injection Attacks

Essential tool for finding blind injection attacks using DNS side-channels. Credits This tool is part of secapps.com open-source initiative. / | / | /\ | \ / | \ \ | / | / /\ \ |/// \| || |/ https://secapps.com NB : This tool is taking advantage of http://requestbin.net service. Future versions...

CVE-2018-10992

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU...

CVE-2019-5434

CVE-2019-5434 affecting Revive Adserver 4.2. The vulnerability is a deserialization/unsafe unserialize() trigger in the XML-RPC script (openads.spc) via the what parameter, allowing an attacker to execute arbitrary code on the target. The issue is tied to Revive Adserver 4.2.0+ and server-side PH...

Security Updates for Exchange (April 2019)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access OWA fails to properly handle web requests. An attacker who...

Netartmedia PHP Dating Site - SQL Injection

Netartmedia PHP Dating Site - SQL Injection Exploit Title: Netartmedia Php Dating Site - SQL Injection Date: 19.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/datingsite/ Demo Site: https://www.phpscriptdemos.com/dating/ Version: Lastest Tested on: Kali Lin...