Xxe

An XML External Entity Injection XXE vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 18915...

CVE-2020-4772

An XML External Entity Injection XXE vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 18915...

CVE-2020-4772

The CVE-2020-4772 XXE vulnerability affects IBM Cúram Social Program Management (Curam SPM) 7.0.9 and 7.0.10. The root cause is an XML External Entity Injection flaw in Curam SPM components, leading to potential exposure of sensitive data and the possibility of DoS, SSRF, or memory/resource exhau...

[SECURITY] Fedora 31 Update: prosody-0.11.7-1.fc31

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

[SECURITY] Fedora 32 Update: prosody-0.11.7-1.fc32

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

Security Bulletin: An XML External Entity Injection (XXE) vulnerability may impact IBM Cúram Social Program Management (CVE-2020-4772)

Summary An XML External Entity Injection XXE vulnerability may impact IBM Cúram Social Program Management. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. Vulnerability Details CVEID:...

Security Bulletin: IBM Security Guardium is affected by a kernel vulnerability

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2019-3882 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by the failure to restrict violation of the user's locked memory limit by the vfio interface implementation. If a device is...

The vulnerability of the RPD daemon in the JunOS operating system, allowing a intruder to trigger a maintenance failure

The vulnerability of the RPD daemon in the JunOS operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the D-Bus inter-process communication system, caused by synchronization errors when using shared resources, allows a malicious actor to trigger a service failure.

The vulnerability of the D-Bus inter-process communication system arises due to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure due to the absence of a function for checking the “ActivationFailure” signal source...

Grindr's Bug Bounty Pledge Doesn't Translate to Security

SAS@Home 2020– After a Grindr security flaw was disclosed this week, the dating site promised it would launch a bug-bounty program in an effort to “keep its service secure.” But Katie Moussouris, CEO of Luta Security and a bug bounty program expert, warned at this week’s SAS@home virtual event th...

CVE-2020-15598

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial...

CVE-2020-25802 Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7...

[SECURITY] Fedora 33 Update: prosody-0.11.7-1.fc33

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

[SECURITY] [DLA 2389-1] ruby-rack-cors security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2389-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta October 01, 2020 https://wiki.debian.org/LTS -...

U.S. Dept Of Defense: param allows any external resource to be downloadable | https://████████

Description: The following param allows an attacker to trick people into downloading malicious files, scripts and other payloads. https://██████████?url=https:// PoC 1. I will show you how the page looks normally without any changes. If you directly access https://███ you will be shown the...

The vulnerability of the JunOS operating system, related to synchronization errors when using shared resources, allows a hacker to alter the device’s configuration.

The vulnerability of the JunOS operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to modify the device’s configuration...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

Design/Logic Flaw

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...