9219 matches found
EulerOS 2.0 SP5 : libpng (EulerOS-SA-2019-1912)
According to the version of the libpng packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libpng before 1.6.32 does not properly check the length of chunks against the user limit.CVE-2017-12652 Note that Tenable Network Security has...
Windows Common Log File System Driver Information Disclosure Vulnerability
An information disclosure exists in the Windows Common Log File System CLFS driver when it fails to properly handle sandbox checks. An attacker who successfully exploited this vulnerability could potentially read data outside their expected limits. To exploit the vulnerability, an attacker would...
GitLab Restriction Bypass Vulnerability (CNVD-2019-31324)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...
Fedora 29 : clamav (2019-aabcb53ec6)
ClamAV 0.101.4 is a security patch release that addresses the following issues. - An out of bounds write was possible within ClamAV's NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library CVE-2019-12900. The issue has bee...
GGPowerShell / Windows PowerShell Remote Command Execution
from base64 import b64encode from base64 import b64decode from socket import import argparse,sys,socket,struct,re GGPowerShell Microsoft Windows PowerShell - Unsantized Filename RCE Dirty File Creat0r. Original advisory:...
Ubuntu 16.04 LTS / 18.04 LTS : Apache HTTP Server vulnerabilities (USN-4113-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4113-1 advisory. Stefan Eissing discovered that the HTTP/2 implementation in Apache did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in some...
CVE-2019-15784
Secure Reliable Transport SRT through 1.3.4 has a CSndUList array overflow if there are many SRT connections...
Cisco NX-OS Software Privilege License and Access Control Issues Vulnerability
Cisco NX-OS Software is a set of data center-grade operating system software for switches from the U.S. company Cisco Cisco. A permission and access control issue vulnerability exists in the Simple Network Management Protocol Access Control Column feature of Cisco NX-OS Software, which can be...
SUSE-SU-2019:2227-1 Security update for libvirt
This update for libvirt fixes the following issues: Security issues fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd...
SUSE-SU-2019:2227-2 Security update for libvirt
This update for libvirt fixes the following issues: Security issues fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd...
WordPress limit-attempts plugin SQL injection vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blogs on PHP and MySQL servers. limit-attempts is a website security plugin that targets spam and brute-force attacks. A SQL injection vulnerability exists in the WordPres...
UBUNTU-CVE-2019-6474
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea cod...
Fedora 30 : clamav (2019-5c2dc50262)
ClamAV 0.101.4 is a security patch release that addresses the following issues. - An out of bounds write was possible within ClamAV's NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library CVE-2019-12900. The issue has bee...
CVE-2015-9335
The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling...
Sql injection
The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling...
CVE-2015-9335
The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling...
CVE-2015-9335
CVE-2015-9335 : A SQL injection vulnerability exists in the WordPress limit-attempts plugin prior to version 1.1.1 during IP address handling. This affects the plugin used with WordPress, enabling potentially unauthorized SQL commands through crafted input. The CVSS indications show high impact (...
PT-2019-17042 · Ibm · Ibm Security Guardium Big Data Intelligence
Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Big Data Intelligence version 4.0 Description: The issue is related to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume...
curl security and bug fix update
7.29.0-54.0.1 - Security Fixes OraBug: 28939992 - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitive password comparison https://curl.haxx.se/docs/CVE-2016-8616.html - CVE-2016-8617 OOB write via unchecked multiplication...
The vulnerability of the IcedTea-Web plugin, related to an incorrect limitation on the path name to the restricted access catalog, allows a hacker to write arbitrary files to the device’s file system.
The vulnerability of the IcedTea-Web plugin is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system using a specially crafted file in formats: .tar, .jar, .war,...