Security fix for the ALT Linux 10 package python3-module-django version 2.2.19-alt1

Feb. 24, 2021 Alexey Shabalin 2.2.19-alt1 - 2.2.19 - rename package to python3-module-django back - Fixes for the following security vulnerabilities: + CVE-2021-3281 Potential directory-traversal via archive.extract + CVE-2021-23336 Web cache poisoning via django.utils.http.limitedparseqsl...

crate has been renamed to `qjsonrpc`

This crate has been renamed from jsonrpc-quic to qjsonrpc. The new repository location is:...

GNU Binutils 后置链接漏洞

GNU Binutils GNU Binary Utilities or binutils is a set of programming language utility programs developed by the GNU community. The programs are primarily designed to work with target files in a variety of formats, and provide linkers, assemblers, and other tools for target files and archives. An...

CVE-2020-25106

Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename...

CVE-2020-25106

CVE-2020-25106 affects Nanosystems SupRemo 4.1.3.2348. When running as a service, File Manager can modify system-privileged files, allowing an attacker to rename Supremo.exe and upload a Trojan to achieve LocalSystem access. Vulnerable version: 4.1.3.2348. Fixed version: 4.2.0.2423. Exploitation ...

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55 during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request causing a Denial of Service.

...

crate has been renamed to `sn_client`

This crate has been renamed from safecore to snclient. The new repository location is:...

RUSTSEC-2020-0086 crate has been renamed to `sn_client`

This crate has been renamed from safecore to snclient. The new repository location is:...

Papermerge Cross-Site Scripting Vulnerability

Papermerge is an open source document management system DMS for archiving and retrieving digital documents. Multiple cross-site scripting vulnerabilities exist in versions prior to Papermerge 1.5.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...

PYSEC-2020-74

Multiple cross-site scripting XSS vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in...

PYSEC-2020-74

Multiple cross-site scripting XSS vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in...

CVE-2020-29456

Multiple cross-site scripting XSS vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in...

HorizontCMS 1.0.0-beta Shell Upload Exploit

This Metasploit module exploits an arbitrary file upload vulnerability in HorizontCMS 1.0.0-beta in order to execute arbitrary commands. The module first attempts to authenticate to HorizontCMS. It then tries to upload a malicious PHP file via an HTTP POST request to /admin/file-manager/fileuploa...

PT-2020-16679 · Flexdotnetcms · Flexdotnetcms

Name of the Vulnerable Software and Affected Versions: FlexDotnetCMS versions prior to 1.5.9 Description: The issue allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code in the form of a safe file type and then renaming the...

PT-2020-16680 · Horizontcms · Horizontcms

Name of the Vulnerable Software and Affected Versions: HorizontCMS versions prior to 1.0.0-beta patched, but version number remains the same Description: The issue allows an authenticated remote attacker with access to the FileManager to upload and execute arbitrary PHP code. This is achieved by...

PDW File Browser 1.3 - Remote Code Execution

Exploit Title: PDW File Browser 1.3 - Remote Code Execution Date: 24-10-2020 Exploit Author: David Bimmel Researchers: David Bimmel, Joost Vondeling, Ramòn Janssen Vendor Homepage: n/a Software Link: https://github.com/GuidoNeele/PDW-File-Browser Version: … ? Once you have uploaded your webshell...

UBUNTU-CVE-2020-25692

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service...

RUSTSEC-2020-0058 crate has been renamed to `cipher`

This crate has been renamed from stream-cipher to cipher. The new repository location is at:...

CVE-2020-26048

The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension and through a custom request using the rename function provided by the file manager is able to modify the image extension into PHP resulting in remote...