RHEL 6 : kernel (RHSA-2019:1488)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1488 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: An integer overflow flaw was found in...

kernel: Double free in lib/idr.c

A double-free can happen in idrremoveall in lib/idr.c in the Linux kernel. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service DoS...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

XML External Entity injection in Apache Camel

Apache Camel prior to 2.24.0 contains an XML external entity injection XXE vulnerability CWE-611 due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed...

CVE-2019-0188

Apache Camel prior to 2.24.0 contains an XML external entity injection XXE vulnerability CWE-611 due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed...

Xxe

Apache Camel prior to 2.24.0 contains an XML external entity injection XXE vulnerability CWE-611 due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed...

CVE-2019-0188

Apache Camel before 2.24.0 is affected by an XXE vulnerability (CWE-611) caused by an outdated vulnerable JSON-lib in the camel-xmljson component, which has been removed in later releases. The issue is documented with CVE-2019-0188 and has a base score around 5.8 (IBM X-Force reference). Remediat...

CVE-2019-0188

Apache Camel prior to 2.24.0 contains an XML external entity injection XXE vulnerability CWE-611 due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed...

XML External Entity (XXE)

apache camel is vulnerable to XML external entity XXE attacks. The application uses an outdated and vulnerable JSON-lib library, camel-xmljson, which allows an attacker to perform XXE attacks...

Sql injection

AbanteCart 1.2.8 allows SQL Injection via the sourcelanguage parameter to admin/controller/pages/localisation/language.php and core/lib/languagemanager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/backup.php...

Sql injection

admin/Lib/Action/FpluginAction.class.php in FDCMS aka Fangfa Content Manage System 4.2 allows SQL Injection...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12043

CVE-2019-12043 affects remarkable 1.7.1. The vulnerability is in lib/parser_inline.js, where URL filtering is mishandled, allowing cross-site scripting via unprintable characters (demonstrated by a \x0ejavascript: URL). Documents in Red Hat, GHSA and OSV/EUVD Veracode references confirm the XSS i...

CVE-2019-11690

genranduuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIGRANDOMUUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device...

CVE-2019-11690

genranduuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIGRANDOMUUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device...

CVE-2019-11690

genranduuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIGRANDOMUUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device...

CVE-2019-11690

CVE-2019-11690 affects Das U-Boot: gen_rand_uuid in lib/uuid.c in v2014.04–v2019.04. The root cause is a missing srand call when CONFIG_RANDOM_UUID is enabled, which can let an attacker determine UUID values used for GPT boot-device UUIDs. The vulnerability is documented with CVSS2/3 base metrics...

Open-Xchange: Two heap use-after-free errors in IMAP operations

Summary ======= We’ve found two heap use-after-free errors, one in lib-storage/index/index-storage.c: indexcopycachefields and one in lib-index/mail-index-sync-update.c: mailindexsyncrecordreal. Error 1: indexcopycachefields ---------------------------------------------- This error involves two...