Updated glib2.0 packages fix security vulnerability

An issue was discovered in GNOME GLib before 2.66.8. When gfilereplace is used with GFILECREATEREPLACEDESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is...

AZL-6439 CVE-2021-28153 affecting package glib for versions less than 2.60.1-5

An issue was discovered in GNOME GLib before 2.66.8. When gfilereplace is used with GFILECREATEREPLACEDESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is...

ALPINE-CVE-2021-28153

An issue was discovered in GNOME GLib before 2.66.8. When gfilereplace is used with GFILECREATEREPLACEDESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is...

Design/Logic Flaw

An issue was discovered in GNOME GLib before 2.66.8. When gfilereplace is used with GFILECREATEREPLACEDESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is...

GNOME Glib 后置链接漏洞

GNOME Glib is a multi-platform toolkit for creating graphical user interfaces and is the underlying core library for GTK+ and GNOME projects. A security vulnerability exists in GNOME GLib before 2.66.8, which stems from the fact that gfilereplace and GFILECREATEREPLACEDESTINATION incorrectly also...

FUEL CMS SQL注入漏洞

FUEL CMS is a content management system based on CodeIgniter. A SQL injection vulnerability exists in the 'fuelreplaceid' parameter in pages/replace/1 in FUEL CMS 1.4.8. An attacker could use this vulnerability to corrupt the application, access or modify data, or exploit a potential vulnerabilit...

CVE-2020-24791: Improper Neutralization of Special Elements used in an SQL Command

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

PT-2021-5823 · Gnome +9 · Gnome Glib +9

Name of the Vulnerable Software and Affected Versions: GNOME GLib versions prior to 2.66.8 Description: An issue was discovered in GNOME GLib when the g file replace function is used with G FILE CREATE REPLACE DESTINATION to replace a path that is a dangling symlink. It incorrectly creates the...

Shadow Attacks Let Attackers Replace Content in Digitally Signed PDFs

Researchers have demonstrated a novel class of attacks that could allow a bad actor to potentially circumvent existing countermeasures and break the integrity protection of digitally signed PDF documents. Called "Shadow attacks" by academics from Ruhr-University Bochum, the technique uses the...

CVE-2020-13553

An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run Key Privilege Escalation in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with ...

Advantech WebAccess/SCADA 安全漏洞

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A local elevation of privilege...

DEBIAN-CVE-2020-27770

Due to a missing check for 0 value of replaceextent, it is possible for offset p to overflow in SubstituteString, causing potential impact to application availability. This could be triggered by a crafted input file that is processed by ImageMagick. This flaw affects ImageMagick versions prior to...

Authorization

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys...

CVE-2020-2311: Undefined Security Weakness

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration...

CVE-2020-23834

Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to admin by replacing the %SYSTEMDRIVE%\bd\bd.exe file. When the computer next starts, the new bd.exe will be run as LocalSystem...

GHSA-3WJM-33MW-H388 Malicious Package in s3asy

Version 0.4.8 of s3asy contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.4.8 of this module is found installed you will want ...

WordPress Real-Time Find and Replace Plugin Cross-Site Scripting (CVE-2020-13641)

A cross-site scripting vulnerability exists in WordPress Real-Time Find and Replace Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

MailMate Resource Management Error Vulnerability

MailMate is a macOS-based IMAP email client. A resource management error vulnerability exists in MailMate versions prior to 1.11, which stems from the program automatically importing S/MIME certificates and replacing pre-existing certificates by default. An attacker can exploit this vulnerability...

Information Disclosure

Apache solr-core is vulnerable to Information Disclosure. Lack of validation of CoreAdminAPI's parameters consequently lead to search index data exposure and replace index data entirely by loading it from a remote file system...

CVE-2020-12119

Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee RBF. It increases the user's balance with the value of an unconfirmed transaction as soon as it is received before the transaction is confirmed and does not decrease the balance when it is canceled. As a result, users are exposed t...