Command Injection

Overview node-notifier is an A Node.js module for sending notifications on native Mac, Windows post and pre 8 and Linux or Growl as fallback Affected versions of this package are vulnerable to Command Injection. It allows an attacker to run arbitrary commands on Linux machines due to the options...

curl: Incorrect argument check can allow remote servers to overwrite local files

A flaw was found in curl. Overwriting local files is possible when using a certain combination of command line options. Requesting content from a malicious server could lead to overwriting local files with compromised files leading to unknown effects. The highest threat from this vulnerability is...

anaconda bug fix and enhancement update

The anaconda packages contain parts of the Anaconda installation program that allows reconfiguration and advanced installation options. Bug Fixes and Enhancements: Mellanox VPI and CX-4 adapter cards InfiniBand mode PXE boot of RHEL8.3 failed BZ1890261...

EulerOS 2.0 SP2 : curl (EulerOS-SA-2020-2337)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl's multi API, and sets...

DEBIAN-CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

Code injection

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

UBUNTU-CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

CVE-2020-7746

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deeply merged with provided options. However, during this operation, the keys of the object being...

Cross-site Scripting (XSS)

github.com/grafana/grafana is vulnerable to cross-site scripting XSS. The vulnerability exists when specifying series alias such as test data or elastic search, which allows special characters, caused by the bs-typeahead directive that evals the select options passed to it...

SRC-2021-0018 : Microsoft SharePoint Server OAuth Authorization Code Leak Elevation of Privilege Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to elevate privileges. User interaction is required required to exploit this vulnerability. The specific flaw exists in the oauthauthorize page. The issue results from a missing X-Frame-Options header when performing an authorizati...

PT-2020-6799 · Chart.Js · Chartjs

Name of the Vulnerable Software and Affected Versions: chart.js versions prior to 2.9.4 Description: The issue is related to the options parameter not being properly sanitized when processed. This leads to a prototype pollution when the existing options or default options are deeply merged with...

Mailman 1.x > 2.1.23 - Cross Site Scripting (XSS)

Title: Mailman 1.x 2.1.23 - Cross Site Scripting XSS Type: Reflected XSS Software: Mailman Version: =1.x = 2.1.23 Vendor Homepage: https://www.list.org Original link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5950 POC Author: Valerio Alessandroni Date: 28/10/2020 Description:...

Recommended update for mailman (moderate)

openSUSE Security Update: Recommended update for mailman Announcement ID: openSUSE-SU-2020:1752-1 Rating: moderate References: 1171363 1173369 Cross-References: CVE-2020-12108 CVE-2020-12137 CVE-2020-15011 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes three vulnerabilities...

Microsoft IE Browser Death March Hastens

As the death of the once dominant Internet Explorer IE draws closer, Microsoft is quickly pounding more nails into the browser’s coffin. On Monday, Microsoft hastened its IE-to-Edge browser-transition strategy and announced new controls for users and IT staff when it comes to how the lame-duck...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20201001)

Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3 CVE-2020-15673 - Mozilla: Integer overflow in nsJPEGEncoder::emptyOutputBuffer CVE-2020-12422 - Mozilla: X-Frame-Options bypass using object or embed tags CVE-2020-15648 - Mozilla: Bypassing iframe sandbox whe...

How to Configure ICA Session Timeout Values for Access Gateway Enterprise Edition Sessions

This article describes how to configure different ICA session timeout values for the same ICA-published resource when Access Gateway Enterprise Edition is using secure gateway proxy mode. This involves creating an additional ICA listener on each XenApp server, modifying the terminal server settin...

WordPress TI WooCommerce Wishlist Premium plugin <= 1.21.4 - Authenticated WP Options Change vulnerability

Authenticated WP Options Change vulnerability found by Jerome Bruandet NinTechNet in WordPress TI WooCommerce Wishlist Premium plugin versions = 1.21.4. Solution Update the WordPress TI WooCommerce Wishlist Premium plugin to the latest available version at least 1.21.5...

WordPress TI WooCommerce Wishlist plugin <= 1.21.11 - Authenticated WP Options Change vulnerability

Authenticated WP Options Change vulnerability found by Jerome Bruandet NinTechNet in WordPress TI WooCommerce Wishlist plugin versions = 1.21.11. Solution Update the WordPress TI WooCommerce Wishlist plugin to the latest available version at least 1.21.12...