DLA-1609-1 libapache-mod-jk - security update

Bulletin has no description...

Debian: Security Advisory (DLA-1609-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for openvswitch (moderate)

This update for openvswitch to version 2.7.6 fixes the following issues: These security issues were fixed: - CVE-2018-17205: Prevent OVS crash when reverting old flows in bundle commit bsc1104467. - CVE-2018-17206: Avoid buffer overread in BUNDLE action decoding bsc1104467. - CVE-2018-17204:When...

Valve: Malformed BSP in GoldSrc Engine may cause shellcode injection

Introduction Hello. There's a vulnerability in GoldSrc Engine that allows to run arbitrary assembly code using incorrect BSP format processing. Description The vulnerability is found in the UTILStringToIntArray function. This function belongs to the game mod library mp.dll/cs.so and has the...

PT-2018-15159

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.8.3 Description The issue allows remote attackers to execute arbitrary commands when mod xml rpc is enabled. This can be achieved via the api/system or txtapi/system or api/bg system or txtapi/bg system query...

USN-3825-1 libapache2-mod-perl2 vulnerability

Jan Ingvoldstad discovered that modperl incorrectly handled configuration options to disable being used by unprivileged users, contrary to the documentation. A local attacker could possibly use this issue to execute arbitrary Perl code...

PT-2018-14916

Name of the Vulnerable Software and Affected Versions kimsQ Rb version 2.3.0 Description The issue allows for XSS via the second input field to the "/?r=home&mod=mypage&page=info" API endpoint. Recommendations For version 2.3.0, consider restricting access to the "/?r=home&mod=mypage&page=info" A...

CVE-2018-19324: Improper Neutralization of Input During Web Page Generation

kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI...

httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of modcachesocache. The vulnerability is considere...

FruityWifi Code Execution Vulnerability

FruityWifi is a wireless network auditing tool. A security vulnerability exists in the www/modules/save.php file in FruityWifi 2.4 and earlier versions. A remote attacker can exploit this vulnerability by sending a specially crafted 'modname' parameter via a POST request to execute arbitrary code...

Design/Logic Flaw

Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...

PT-2018-14838

Name of the Vulnerable Software and Affected Versions FruityWifi versions through 2.4 Description The issue allows remote attackers to execute arbitrary code with root privileges via a crafted mod name parameter in a POST request to the "/www/modules/save.php" API endpoint. This can be exploited...

UBUNTU-CVE-2018-19052

An issue was discovered in modaliasphysicalhandler in modalias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific modalias configuration where the matched alias lacks a trailing '/' character, but the alias target...

CVE-2018-18935

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account...

PT-2018-14731

Name of the Vulnerable Software and Affected Versions PopojiCMS version 2.0.1 Description The issue concerns a CSRF problem. It can be exploited via the "po-admin/route.php?mod=component&act=addnew" URI, allowing actions such as adding a level=1 account. Recommendations For PopojiCMS version 2.0....

PT-2018-14732

Name of the Vulnerable Software and Affected Versions PopojiCMS version 2.0.1 Description An issue in admin library.php allows remote attackers to delete arbitrary files via directory traversal in the "po-admin/route.php?mod=library&act=delete" endpoint, specifically using the id parameter...

PT-2018-19288

Name of the Vulnerable Software and Affected Versions lighttpd affected versions not specified Description The issue involves several security concerns, including potential path traversal in mod alias under specific configurations or use cases, use-after-free errors due to invalid Range requests ...

PT-2018-19237

Name of the Vulnerable Software and Affected Versions apache2-mod nss affected versions not specified Description The issue is related to the update of mozilla-nss, which requires apache2-mod nss to be updated to use the SQLite certificate database. This update is tagged as a security update to...

PT-2018-14486

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description An issue exists in the software, allowing SQL injection via the "admin.php?mod=user&act=del" API endpoint, specifically through the user id parameter. Recommendations For PHPSHE version 1.7, avoid using the user ...

PT-2018-14485

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter in the "admin.php?mod=db&act=del" API endpoint. This can be leveraged to...