CVE-2018-19434: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15. BankMatching.php has Blind SQL injection via the AmtClear parameter...

PT-2018-14960

Name of the Vulnerable Software and Affected Versions webERP version 4.15 Description An issue was discovered on the Bank Account Matching - Receipts screen of the General Ledger component. This issue involves Blind SQL injection via the AmtClear parameter in BankMatching.php. Recommendations For...

[SECURITY] Fedora 29 Update: suricata-4.0.6-1.fc29

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-threading, Automatic...

[SECURITY] Fedora 27 Update: suricata-4.0.6-1.fc27

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-threading, Automatic...

F5 Networks BIG-IP : F5 BIG-IP TMM vulnerability (K31404801)

In versions 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2, an F5 BIG-IP virtual server using the URL categorization feature may cause the Traffic Management Microkernel TMM to produce a core file when it receives malformed URLs during categorization. CVE-2017-6169. Impact An attacker may be able to...

Real-time File Scanning System: Strelka

Strelka is a real-time file scanning system used for threat hunting, threat detection, and incident response. Based on the design established by Lockheed Martin’s Laika BOSS and similar projects, Strelka’s purpose is to perform file extraction and metadata collection at huge scale. Strelka differ...

Spring Security and Spring Framework may not recognize certain paths that should be protected

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x as well as other unsupported versions rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms,...

Apache Ranger policy engine incorrectly matches paths in certain conditions

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true...

GHSA-XV7X-X6WR-XX7G Apache Ranger policy engine incorrectly matches paths in certain conditions

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true...

SUSE-SU-2018:2719-1 Security update for openssh-openssl1

This update for openssh-openssl1 fixes the following issues: These security issues were fixed: - CVE-2016-10708: Prevent NULL pointer dereference via an out-of-sequence NEWKEYS message allowed remote attackers to cause a denial of service bsc1076957. - CVE-2017-15906: The processopen function did...

pcre: Out-of-bounds read in compile_bracket_matchingpath function (8.41/3)

The compilebracketmatchingpath function in pcrejitcompile.c in PCRE through 8.x before revision 1680 e.g., the PHP 7.1.1 bundled version allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted regular expression...

[SECURITY] Fedora 27 Update: mutt-1.9.2-2.fc27

Mutt is a small but very powerful text-based MIME mail client. Mutt is highly configurable, and is well suited to the mail power user with advanced features like key bindings, keyboard macros, mail threading, regular expression searches and a powerful pattern matching language for selecting group...

Comparison of Application Security Testing Approaches

Overview The following table lists a side-by-side comparison of different application security testing approaches. Additional rating details are available when hovering over each column. In the following, each approach is introduced. Category Automated Security Testing Manual Security Testing...

[SECURITY] Fedora 28 Update: suricata-4.0.5-1.fc28

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-threading, Automatic...

[SECURITY] Fedora 27 Update: suricata-4.0.5-1.fc27

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-threading, Automatic...

DNS Rebinding Attacks

mitmproxy is vulnerable to DNS rebinding attacks. The vulnerability exists due to the lack of enforcement of hostname matching, allowing DNS rebinding attacks...

DEBIAN-CVE-2017-5440

A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1,...

Regular Expression Denial Of Service (ReDoS)

no-case is vulnerable to regular expression denial of service ReDoS attacks. The library does not properly sanitize user input strings, causing slowdown when matching strings that can lead to a ReDoS...

CVE-2015-9240

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in...

PT-2018-4553

Name of the Vulnerable Software and Affected Versions keystone versions prior to 0.3.16 Description The issue is related to a bug in the default sign in functionality, where incomplete email addresses could be matched, potentially allowing for partial authentication bypass. A correct password is...