CVE-2019-1000021

CVE-2019-1000021 affects the Python XMPP library slixmpp, specifically the XEP-0223 plugin (Persistent Storage of Private Data via PubSub). Affected versions are before commit 7cd73b594e8122dddf847953fcfc85ab4d316416, where an incorrect Access Control configuration could allow private data publis...

CVE-2019-1000021: Undefined Security Weakness

slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin Persistent Storage of Private Data via PubSub options profile, used for the configuration of default access model that can result in all of the contacts of...

slixmpp -- improper access control

NVD reports: slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin Persistent Storage of Private Data via PubSub options profile, used for the configuration of default access model that can result in all of the...

dr-michael-bohne.de XSS vulnerability

Open Bug Bounty ID: OBB-677031 Description| Value ---|--- Affected Website:| dr-michael-bohne.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

openSUSE Security Update : enigmail (openSUSE-2018-470) (EFAIL)

This update for enigmail to version 2.0.4 fixes multiple issues. Security issues fixed : - CVE-2017-17688: CFB gadget attacks allowed to exfiltrate plaintext out of encrypted emails. enigmail now fails on GnuPG integrity check warnings for old Algorithms bsc1093151 - CVE-2017-17689: CBC gadget...

pep-web.org IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-594460 Description| Value ---|--- Affected Website:| pep-web.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

Information Leakage

Converse.js is vulnerable to information leakage. Access models are not taken into account when storing bookmarks on the server. This means that bookmarks uploaded into Personal Eventing Protocol PEP are accessible by all contacts...

CVE-2017-17845

An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random is used by pretty Easy privacy pEp, aka TBE-01-001...

CVE-2017-17845

CVE-2017-17845 affects Enigmail (Thunderbird extension) before 1.9.9. The issue is improper random secret generation because Math.Random() is used by pretty Easy privacy (pEp). Impact: potential confidentiality/integrity/availability concerns as per CVSS metrics (base score 7.3–7.5, HIGH). Affect...

PT-2017-15041

Name of the Vulnerable Software and Affected Versions Enigmail versions prior to 1.9.9 Description An issue was discovered in Enigmail where improper random secret generation occurs due to the use of Math.Random by pretty Easy privacy pEp. Recommendations For versions prior to 1.9.9, update to...

Memory Corruption Vulnerability in the XGT PANEL Software of LS (Formerly LG) Korea

XGT PANEL Panel Editor is an editor. A memory corruption vulnerability exists in the XGT PANEL software from LS General Electric formerly LG General Electric in South Korea when handling customized pep files. An attacker can crash the application by constructing a malformed file, which if...

pep-web.org XSS vulnerability

Open Bug Bounty ID: OBB-162260 Description| Value ---|--- Affected Website:| pep-web.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Uber: Stored XSS in archive.uber.com Due to Injection of Javascript:alert(0)

archive.uber.com is vulnerable to an XSS due to injection of Javascript:alert0 as the downloadurl or the homepage in the setup.py when generating the .tar.gz. As of PEP 0470, the downloadurl and homepage parameters are depreciated. An example of a setup.py that can exploit this is: python from...

CentOS 7 : python (CESA-2015:2101)

Updated python packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

python, tkinter security update

CentOS Errata and Security Advisory CESA-2015:2101 Updated python packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common...

Moderate: Red Hat Security Advisory: python security, bug fix, and enhancement update

Updated python packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

[SECURITY] Fedora 13 Update: python-paste-1.7.4-1.fc13

These provide several pieces of "middleware" or filters that can be nested to build web applications. Each piece of middleware uses the WSGI PEP 333 interface, and should be compatible with other middleware based on those interfaces...

Unfixed XSS vulnerability at www.pep-web.org

Security researcher TreX, has submitted on 31/03/2008 a cross-site-scripting XSS vulnerability affecting www.pep-web.org, which at the time of submission ranked 68583 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 25/04/2008. It is currently...