10225 matches found
Product Lister for Walmart <= 1.0.0 - Unauthenticated RCE via Outdated PHPUnit
The plugin uses an outdated PHPUnit library, which is known to be affected by an unauthenticated RCE issue. February 28th, 2020 - Ticket sent to vendor via https://support.cedcommerce.com/open.php March 6th, 2020 - Update requested to vendor also realised that the ticket was closed w/o reason giv...
Multiple plugins - Unauthenticated Dompdf Local File Inclusion (LFI)
Multiple plugins were found to be vulnerable to the Dompdf unauthenticated Local File Inclusion LFI vulnerability CVE-2014-2383. PoC...
Multiple plugins - Unauthenticated Dompdf Local File Inclusion (LFI)
Multiple plugins were found to be vulnerable to the Dompdf unauthenticated Local File Inclusion LFI vulnerability CVE-2014-2383...
SUSE SLES15 Security Update : cni, cni-plugins, conmon, fuse-overlayfs, podman (SUSE-SU-2020:0697-1)
This update for cni, cni-plugins, conmon, fuse-overlayfs, podman fixes the following issues : podman was updated to 1.8.0 : CVE-2019-18466: Fixed a bug where podman cp would improperly copy files on the host when copying a symlink in the container that included a glob operator 3829 bsc1155217 The...
SUSE-SU-2020:0697-1 Security update for cni, cni-plugins, conmon, fuse-overlayfs, podman
This update for cni, cni-plugins, conmon, fuse-overlayfs, podman fixes the following issues: podman was updated to 1.8.0: - CVE-2019-18466: Fixed a bug where podman cp would improperly copy files on the host when copying a symlink in the container that included a glob operator 3829 bsc1155217 - T...
GLSA-202003-33 : GStreamer Base Plugins: Heap-based buffer overflow
The remote host is affected by the vulnerability described in GLSA-202003-33 GStreamer Base Plugins: Heap-based buffer overflow It was discovered that GStreamer Base Plugins did not correctly handle certain malformed RTSP streams. Impact : A remote attacker could entice a user to open a specially...
Kubernetes: IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements
This bug report mostly concerns the default CNI plugins https://github.com/containernetworking/plugins but I believe affects many K8S clusters. Because the CNI team still doesn’t provide an explicit way to report security bugs, I hope the K8S security team doesn’t mind doing the coordination job...
GStreamer Base Plugins: Heap-based buffer overflow
Background A well-groomed and well-maintained collection of GStreamer plug-ins and elements, spanning the range of possible types of elements one would want to write for GStreamer. Description It was discovered that GStreamer Base Plugins did not correctly handle certain malformed RTSP streams...
CVE-2020-10576
An issue was discovered in Janus through 0.9.1. plugins/janusvoicemail.c in the VoiceMail plugin has a race condition that could cause a server crash...
PT-2020-12215
Name of the Vulnerable Software and Affected Versions Janus versions through 0.9.1 Description The issue is related to a race condition in the VideoCall plugin, specifically in the plugins/janus videocall.c file, which causes improper session management. This happens because some references are...
CVE-2020-10575: Concurrent Execution using Shared Resource with Improper Synchronization
An issue was discovered in Janus through 0.9.1. plugins/janusvideocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times...
Multiple WebToffee Plugins - Cross-Site Request Forgery (CSRF) Issue
From https://www.wordfence.com/blog/2020/03/vulnerability-patched-in-import-export-wordpress-users/ at the bottom "Several additional WooCommerce-centric import/export plugins from WebToffee used the same import functionality. However, they were unable to be activated unless WooCommerce was...
Popular ThemeREX WordPress Plugin Opens Websites to RCE
A critical vulnerability in a WordPress plugin known as “ThemeREX Addons” could open the door for remote code execution in tens of thousands of websites. According to Wordfence, the bug has been actively exploited in the wild as a zero-day. The plugin, which is installed on approximately 44,000...
Popular ThemeREX WordPress Plugin Opens Websites to RCE
A critical vulnerability in a WordPress plugin known as “ThemeREX Addons” could open the door for remote code execution in tens of thousands of websites. According to Wordfence, the bug has been actively exploited in the wild as a zero-day. The plugin, which is installed on approximately 44,000...
ansible: secrets disclosed on logs when no_log enabled
Ansible was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process...
Fedora 31 : seamonkey (2020-bf6ca75fec)
Upgrade to 2.53.1 SeaMonkey-2.53.1, being initially based on the Firefox-56 and Thunderbird-56 code, incorporates now a lot of backported features and security fixes from the newer Firefox/Thunderbird versions up to 75. That way it tries to be a modern browser, preserving the same time the famili...
Denial Of Service (DoS)
github.com/micro/go-plugins is vulnerable to denial of service DoS attacks. The vulnerability is possible due to an invalid memory access in 'Leader' function in leader.go allowing an attacker to cause an application crash...
Debian DLA-2126-1 : gst-plugins-base0.10 security update
Some isses have been found in gst-plugins-base0.10, a package that provides GStreamer plugins from the 'base' set. All issues are related to crafted ico-files that could result in an out-of-bounds read or crafted video- and ASDF-files that could produce floating point exceptions, which could caus...
[SECURITY] [DLA 2126-1] gst-plugins-base0.10 security update
Package : gst-plugins-base0.10 Version : 0.10.36-2+deb8u2 CVE ID : CVE-2016-9811 CVE-2017-5837 CVE-2017-5844 Some isses have been found in gst-plugins-base0.10, a package that provides GStreamer plugins from the "base" set. All issues are related to crafted ico-files that could result in an...