5662 matches found
Ruby on Rails Query Manipulation Vulnerability (Feb 2013)
Ruby on Rails is prone to a query manipulation vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rubyonrails:rails";...
Security Bulletin: Vulnerabilities in OpenSSH affect AIX (CVE-2018-20685 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111)
Summary Vulnerabilities in OpenSSH affect AIX. Vulnerability Details CVEID: CVE-2019-6109 DESCRIPTION: OpenSSH could allow a remote attacker to conduct spoofing attacks, caused by missing character encoding in the progress display. A man-in-the-middle attacker could exploit this vulnerability to...
SUSE SLED12 Security Update : podofo (SUSE-SU-2019:1849-1)
This update for podofo fixes the following issues : Security issues fixed : CVE-2017-8054: Fixed a vulnerability in PdfPagesTree::GetPageNodeFromArray function which could allow remote attackers to cause Denial of Service bsc1035596. CVE-2018-5783: Fixed an uncontrolled memory allocation in...
CVE-2019-13161
An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chansip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to a...
CVE-2019-13374
A cross-site scripting XSS vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter...
Security Bulletin: IBM Security Identity Manager Virtual Appliance is affected by multiple vulnerabilities (CVE-2018-1902, CVE-2018-1968, CVE-2019-4046)
Summary IBM Security Identity Manager Virtual Appliance ISIM VA has addressed the following vulnerabilities due to remote attacks, sensitive information exposure, and Denial of Service attacks. Vulnerability Details CVEID: CVE-2018-1902 DESCRIPTION: IBM WebSphere Application Server could allow a...
CVE-2018-16249
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...
Code injection
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...
CVE-2018-16249
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...
Mozilla Firefox ESR Security Advisories (MFSA2019-16, MFSA2019-18) - Mac OS X
Mozilla Firefox ESR is prone to a type confusion vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2019-6756
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF 9.4.0.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...
Authorization Bypass
Artifex Ghostscript is vulnerable to authorization bypass attacks. This exists in the psi/zicc.c file which allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion...
Security Bulletin: Multiple Security Vulnerabilities affect IBM Cloud Private Kubernetes
Summary Multiple Security Vulnerabilities affect IBM Cloud Private Kubernetes Vulnerability Details CVEID: CVE-2019-4119 DESCRIPTION: IBM Cloud Private Kubernetes API server can be used as an HTTP proxy to not only cluster internal but also external target IP addresses. CVSS Base Score: 3.1 CVSS...
Information Disclosure
Red Hat OpenShift Enterprise is a cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. Refer to the Red Hat OpenShift Enterprise 1.1 Release Notes for information about the changes in this release. The Release Notes will be available shortly fr...
Security Bulletin: Content Collector for Email is affected by a Client certificates can be spoofed in WebSphere Application Server
Summary Content Collector for Email has addressed the following vulnerability. IBM WebSphere Application Server could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. Vulnerability Details CVEID: CVE-2018-1902 DESCRIPTION: I...
Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server (CVE-2019-0211 CVE-2019-0220)
Summary There are multiple vulnerabilities in the IBM HTTP Server used by WebSphere Application Server. CVE-2019-0211 affects version 9 non-windows platforms only. Vulnerability Details CVEID: CVE-2019-0220 DESCRIPTION: Apache HTTP Server could provide weaker than expected security, caused by URL...
CVE-2018-8913
The vulnerability CVE-2018-8913 affects Synology Web Station prior to version 2.1.3-0139, caused by a missing custom error page. This allows remote attackers to perform phishing attacks using a crafted URL. Impact is phishing capability with partial confidentiality/integrity exposure reported by ...
The vulnerability of the Openwsman package for the Red Hat Enterprise Linux operating system, which allows a hacker to trigger a maintenance failure.
The vulnerability of the Openwsman package for the Red Hat Enterprise Linux operating system is related to resource management errors. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending malicious HTTP requests remotely...
The vulnerability of the Identity Services Engine, a platform for managing network policies, exposes the Cisco Prime Infrastructure monitoring and management system to attacks from insiders. This allows attackers to carry out “man-in-the-middle” type attacks.
The vulnerability of the Identity Services Engine, a platform for managing network policies, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker operating remotely to carry out a “man-in-the-middle” attack...