Privilege Escalation

modcluster is vulnerable to privilege escalation. The root context of the server is registered and exposed by default, allowing a remote attacker to bypass intended access restrictions and gain access to the application via unknown vectors...

Fedora 28 : freedink-dfarc (2018-f2e8788852)

New upstream release Fix directory traversal in D-Mod extractor CVE-2018-0496 1584843 no answer from security team Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and form...

Debian DSA-4357-1 : libapache-mod-jk - security update

Raphael Arrouas and Jean Lejeune discovered an access control bypass vulnerability in modjk, the Apache connector for the Tomcat Java servlet engine. The vulnerability is addressed by upgrading modjk to the new upstream version 1.2.46, which includes additional changes. -...

PT-2018-15325

Name of the Vulnerable Software and Affected Versions Barracuda Message Archiver version 2018 Description The issue concerns an XSS vulnerability in the error msg exception-handling value for the ldap user parameter to the cgi-mod/ldap load entry.cgi module. The injection point of the issue is th...

CVE-2018-20369: Improper Neutralization of Input During Web Page Generation

Barracuda Message Archiver 2018 has XSS in the errormsg exception-handling value for the ldapuser parameter to the cgi-mod/ldaploadentry.cgi module. The injection point of the issue is the AddUpdate module...

[SECURITY] [DSA 4357-1] libapache-mod-jk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4357-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 20, 2018 https://www.debian.org/security/faq -...

PT-2018-9593

Name of the Vulnerable Software and Affected Versions: HotelDruid version 2.3.0 and earlier Description: The issue is related to a SQL Injection vulnerability in the id utente mod parameter of the gestione utenti.php file. This can allow an attacker to dump all database records of the backend web...

DSA-4357-1 libapache-mod-jk - security update

Bulletin has no description...

Debian: Security Advisory (DSA-4357-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1609-1 : libapache-mod-jk security update

A vulnerability has been discovered in libapache-mod-jk, the Apache 2 connector for the Tomcat Java servlet engine. The libapache-mod-jk connector is susceptible to information disclosure and privilege escalation because of a mishandling of URL normalization. The nature of the fix required that...

[SECURITY] [DLA 1609-1] libapache-mod-jk security update

Package : libapache-mod-jk Version : 1.2.46-0+deb8u1 CVE ID : CVE-2018-11759 A vulnerability has been discovered in libapache-mod-jk, the Apache 2 connector for the Tomcat Java servlet engine. The libapache-mod-jk connector is susceptible to information disclosure and privilege escalation because...

DLA-1609-1 libapache-mod-jk - security update

Bulletin has no description...

Debian: Security Advisory (DLA-1609-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for openvswitch (moderate)

This update for openvswitch to version 2.7.6 fixes the following issues: These security issues were fixed: - CVE-2018-17205: Prevent OVS crash when reverting old flows in bundle commit bsc1104467. - CVE-2018-17206: Avoid buffer overread in BUNDLE action decoding bsc1104467. - CVE-2018-17204:When...

Valve: Malformed BSP in GoldSrc Engine may cause shellcode injection

Introduction Hello. There's a vulnerability in GoldSrc Engine that allows to run arbitrary assembly code using incorrect BSP format processing. Description The vulnerability is found in the UTILStringToIntArray function. This function belongs to the game mod library mp.dll/cs.so and has the...

PT-2018-15159

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.8.3 Description The issue allows remote attackers to execute arbitrary commands when mod xml rpc is enabled. This can be achieved via the api/system or txtapi/system or api/bg system or txtapi/bg system query...

USN-3825-1 libapache2-mod-perl2 vulnerability

Jan Ingvoldstad discovered that modperl incorrectly handled configuration options to disable being used by unprivileged users, contrary to the documentation. A local attacker could possibly use this issue to execute arbitrary Perl code...

PT-2018-14916

Name of the Vulnerable Software and Affected Versions kimsQ Rb version 2.3.0 Description The issue allows for XSS via the second input field to the "/?r=home&mod=mypage&page=info" API endpoint. Recommendations For version 2.3.0, consider restricting access to the "/?r=home&mod=mypage&page=info" A...

CVE-2018-19324: Improper Neutralization of Input During Web Page Generation

kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI...

httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of modcachesocache. The vulnerability is considere...