594 matches found
armitagetech.ca Cross Site Scripting vulnerability OBB-1217959
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-4080. Reason: This candidate is a duplicate of CVE-2008-4080.2. Notes: All CVE users should reference CVE-2008-4080.2 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...
Privilege escalation
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files such as the shadow file or privilege escalation by manually adding a new user with sudo privileges on the machine...
kernel security and bug fix update
2.6.32-754.30.2.OL6 - Update genkey bug 25599697 2.6.32-754.30.2 - x86/speculation: Provide SRBDS late microcode loading support Waiman Long - documentation x86/speculation: Add Ivy Bridge to affected list Waiman Long 1827185 CVE-2020-0543 - documentation x86/speculation: Add SRBDS vulnerability...
REST API - Deactivate the REST API
h4. Suggestion Description Confluence Server REST API|https://developer.atlassian.com/confdev/confluence-server-rest-api is active by default and there is no way to deactivate. It should have a similar option like the Enabling the Remote...
Why You Need to Use Rules in Your Yii2 Framework Models
In the previous article, we described the vulnerability discovered in the Yii2 Framework 2.0.35. In this piece, you'll find out how to prevent it. It's a highly recommended read, especially for web developers who want to quickly check the rule settings and fix a detected vulnerability. Yii is an...
git security update
1.8.3.1-23 - Prevent crafted URL containing new lines, empty host or lacks a scheme to cause credential leak. Resolves: CVE-2020-11008...
Huawei Data Communication: Deploying IS-IS Authentication
IS-IS authentication is deployed to prevent attackers from attempting to use the control plane protocol to destroy entries on which forwarding depends, such as routes. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright ...
SimplePHPGal 0.7 Remote File Inclusion
Title: SimplePHPGal 0.7 - Remote File Inclusion Author: h4shur date:2020-05-05 Vendor Homepage: https://johncaruso.ca Software Link: https://johncaruso.ca/phpGallery/ Software Link: https://sourceforge.net/projects/simplephpgal/ Tested on: Windows 10 & Google Chrome Category : Web Application Bug...
Application DoS via the /rendering/wiki endpoint - CVE-2019-20418
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint. Affected versions version 8.8.0 Fixed versions 8.8.0...
ZSQL: Aging Time of Non-Authentication Sessions
To prevent DOS attacks from malicious clients that occupy server resources. Set the UNAUTHSESSIONEXPIRETIME parameter to forcibly disconnect from the server if no authentication is performed at the specified time after the TCP connection is established. SPDX-FileCopyrightText: 2020 Greenbone AG...
Linux: ARP proxy
This prevents ARP packet attacks from affecting the system. This script tests whether the Linux host is configured to disable ARP proxy. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...
Design/Logic Flaw
Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling...
Did Donald Trump and Iran Use Twitter to Prevent a War?
Tweets from US president Donald Trump and Iranian foreign minister Javad Zarif Tuesday offered a fascinating glimpse at how world leaders can communicate more quickly and directly than ever in times of crisis...
CVE-2018-3736
REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-3739. Reason: This candidate is a duplicate of CVE-2018-3739. Notes: All CVE users should reference CVE-2018-3739 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usag...
CVE-2019-18850
TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP methods, also via predictible responses when accessing and interacting with the "SITEPATHQUERY"...
gitea -- multiple vulnerabilities
The Gitea Team reports for release 1.11.0: Never allow an empty password to validate 9682 9683 Prevent redirect to Host 9678 9679 Swagger hide search field 9554 Add "search" to reserved usernames 9063 Switch to fomantic-ui 9374 Only serve attachments when linked to issue/release and if accessible...
yum security, bug fix, and enhancement update
createrepoc 0.11.0-3 - Backport patch to switch off timestamps on documentation in order to remove file conflicts RhBug:1738788 0.11.0-2 - Consistently produce valid URLs by prepending protocol. RhBug:1632121 - modifyrepoc: Prevent doubling of compression test.gz.gz RhBug:1639287 - Correct pkg...
