Privilege Escalation

Nagios is vulnerable to privilege escalation attacks. An attacker who is able to control the Nagios logging configuration the 'nagios' user/group, could use this flaw to elevate their privileges to root which leads to information modification...

Cross-Site Scripting (XSS)

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller MVC framework for web application development. Action Pack implemen...

Arbitrary Command Execution

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller MVC framework for web application development. Action Pack implemen...

Denial Of Service (DoS)

Red Hat JBoss Web Server is vulnerable to denial of service. A buffer over-read flaw was found in the httpd modlogconfig module. In configurations where cookie logging is enabled, a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie...

Fedora 30 : systemd (2019-7322053e74)

Fix hang in flushaccept 1702358 - Fix handling of RUN keys in udevd - Some documentation and minor logging fixes - Backport the addition of RestrictSUIDSGID= from systemd-242 and enable RestrictSUIDSGID=yes for systemd services which use DynamicUser=yes 1703356, CVE-2019-3843. The defaults in...

Moderate: Red Hat Security Advisory: openstack-cinder security and bug fix update

An update for openstack-cinder is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

[SECURITY] Fedora 30 Update: libqb-1.0.5-1.fc30

libqb provides high-performance, reusable features for client-server architecture, such as logging, tracing, inter-process communication IPC, and polling...

Sierra Wireless AirLink ES450 Operating System Command Injection Vulnerability

The Sierra Wireless AirLink ES450 is a cellular network modem device from Sierra Wireless Canada. An operating system command injection vulnerability exists in the ACEManager iplogging.cgi function in the Sierra Wireless AirLink ES450 with firmware version 4.9.3, which can be exploited by an...

Mail.ru: [authdl.mail.ru] Spoofing IP address

Client IP address could be spoofed via X-Forwarded-For headers in authdl.mail.ru. While no direct impact were identified, this issue could potentially lead to issues with logging, limitations or ABF protection...

jackson-databind: arbitrary code execution in slf4j-ext class

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code...

CVE-2019-9734

CVE-2019-9734 affects Aquarius CMS up to version 4.3.5, where an overwriting of configuration parameters causes POST and GET parameters (including passwords) to be written to a log file. The impact is exposure of credentials via logging under certain circumstances. The connected documents do not ...

openSUSE Security Update : libqt5-qtvirtualkeyboard (openSUSE-2019-1259)

This update for libqt5-qtvirtualkeyboard fixes the following issues : Security issue fixed : - CVE-2018-19865: Fixed an issue with verbose keypress logging boo1118593. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

OPENSUSE-SU-2019:1263-1 Security update for libqt5-qtvirtualkeyboard

This update for libqt5-qtvirtualkeyboard fixes the following issues: Security issue fixed: - CVE-2018-19865: Fixed an issue with verbose keypress logging boo1118593. This update was imported from the openSUSE:Leap:15.0:Update update project...

OPENSUSE-SU-2019:1259-1 Security update for libqt5-qtvirtualkeyboard

This update for libqt5-qtvirtualkeyboard fixes the following issues: Security issue fixed: - CVE-2018-19865: Fixed an issue with verbose keypress logging boo1118593...

Security update for libqt5-qtvirtualkeyboard (moderate)

openSUSE Security Update: Security update for libqt5-qtvirtualkeyboard Announcement ID: openSUSE-SU-2019:1263-1 Rating: moderate References: 1118593 Cross-References: CVE-2018-19865 Affected Products: openSUSE Backports SLE-15 An update that fixes one vulnerability is now available. Description:...

Sensitive Data Exposure

Overview Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text. Recommendation Upgrade to version 5.5.0 or later...

jackson-databind: arbitrary code execution in slf4j-ext class

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code...

[SECURITY] Fedora 30 Update: systemd-241-7.gita2eaa1c.fc30

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

CVE-2019-8513

creationtimestamp| type| source ---|---|--- 2019-04-13 18:51:06+00:00| published-proof-of-concept| https://t.me/antichat/4432 2019-04-13 20:10:59+00:00| published-proof-of-concept| https://t.me/canyoupwnme/5400 2019-06-29 10:52:23+00:00| seen|...

CVE-2019-9976

The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the credentials of administration web interface users...