Prototype Pollution in chartkick

Affected versions of @polymer/polymer are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as "proto": "polluted": true. It is possible to achieve the same results if a chart loads data from a malicio...

Mesmerize & Materialis Themes - Authenticated Options Update

Discovered by NinTechNet, both the Mesmerize and Materialis WordPress themes were affected by an authenticated options update vulnerability. This could allow a lower privileged user to update site options, which they should not be permitted to...

WordPress Materialis theme <=1.0.172 - Authenticated Options Update vulnerability

Authenticated Options Update vulnerability found by NinTechNet in WordPress Materialis theme versions =1.0.172. Solution Update the WordPress Materialis theme to the latest available version at least 1.0.173...

Security update for clamav (moderate)

openSUSE Security Update: Security update for clamav Announcement ID: openSUSE-SU-2019:2597-1 Rating: moderate References: 1144504 1149458 1151839 Cross-References: CVE-2019-12625 CVE-2019-12900 Affected Products: openSUSE Leap 15.0 An update that solves two vulnerabilities and has one errata is...

OPENSUSE-SU-2019:2597-1 Security update for clamav

This update for clamav fixes the following issues: Security issue fixed: - CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files bsc1144504. - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors bsc1149458...

EulerOS 2.0 SP8 : bind (EulerOS-SA-2019-2275)

According to the version of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -...

SUSE-SU-2019:3066-1 Security update for clamav

This update for clamav fixes the following issues: Security issue fixed: - CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files bsc1144504. - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors bsc1149458...

openSUSE Security Update : haproxy (openSUSE-2019-2556)

This update for haproxy to version 2.0.5+git0.d905f49a fixes the following issues : Security issue fixed : - CVE-2019-14241: Fixed a cookie memory corruption problem. bsc1142529 The update to 2.0.5 brings lots of features and bugfixes : - new internal native HTTP representation called HTX, was...

CVE-2019-19066

A flaw was found in the Linux kernel. The bfadimgetstats function mishandles resource cleanup on error. A local attacker, able to induce the error conditions, could use this flaw to crash the system. The highest threat from this vulnerability is to system availability. Mitigation Mitigation for...

SYS.2.2.3.A9

Ziel des Bausteins SYS.2.2.3 ist der Schutz von Informationen, die durch und auf Windows 10-Clients verarbeiten werden. Die Standard-Anforderung SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...

CVE-2011-1930

In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options...

DEBIAN-CVE-2011-1930

In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options...

Code injection

In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options...

CVE-2011-1930

In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options...

Prototype Pollution

Overview Affected versions of @polymer/polymer are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as "proto": "polluted": true. It is possible to achieve the same results if a chart loads data from ...

SUSE-SU-2019:14215-1 Security update for tar

This update for tar to version 1.27.1 fixes the following issues: tar 1.27.1 brings following changes jscECO-339 Sparse files with large data No backticks in quoting --owner and --group names and numbers Support for POSIX ACLs, extended attributes and SELinux context. Passing command line argumen...

Is Service Mesh right for your infrastructure?

Andrew Jenkins of Aspen Mesh identifies three deployment options with regards to how a Service Mesh delivers its services: As a sidecar that runs alongside your microservice container As a library that can be built into each of the microservices As an agent that sit in the container infrastructur...

rConfig - install Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'rConfig install Command Execution', 'Description' = %q This module exploits an unauthenticated command injection vulnerability in rConfig version...

Prototype Pollution

request is vulnerable to prototype pollution attacks. When using filtering options, the package does not ensure that the options object that are passed to the filterForNonReserved method is using a clean object prototype. This allows an attacker to pollute the object and inject malicious values...

CVE-2019-17212

Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparse parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point packetdatapptr i...