CVE-2019-16935

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the servertitle field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If setservertitle is called with untrusted input, arbitrary...

CVE-2019-16935

The CVE-2019-16935 issue concerns the documentation XML-RPC server in Python (Lib/DocXMLRPCServer.py for Python 2.x and Lib/xmlrpc/server.py for Python 3.x). The root cause is that server_title, when set_server_title is called with untrusted input, can deliver arbitrary JavaScript to clients via ...

CVE-2019-16935

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the servertitle field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If setservertitle is called with untrusted input, arbitrary...

EulerOS 2.0 SP3 : samba (EulerOS-SA-2019-2018)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS...

EulerOS 2.0 SP5 : samba (EulerOS-SA-2019-1902)

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS...

CVE-2019-3975

Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message...

Stack overflow

Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message...

CVE-2019-3975

Advantech WebAccess/SCADA 8.4.1 is affected by CVE-2019-3975 due to a stack-based buffer overflow in the webvprcs/IOCTL 70603 RPC handling, enabling a remote, unauthenticated attacker to execute arbitrary code. This is confirmed across multiple sources (Red Hat advisory, CNVD, NVD entry) with imp...

bro -- invalid memory access or heap buffer over-read

Jon Siwek of Corelight reports: This is a security patch release to address a potential Denial of Service vulnerability: The NTLM analyzer did not properly handle AV Pair sequences that were either empty or unterminated, resulting in invalid memory access or heap buffer over-read. The NTLM analyz...

CVE-2019-15642

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

CVE-2019-15642

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

Security update for neovim (important)

openSUSE Security Update: Security update for neovim Announcement ID: openSUSE-SU-2019:1997-1 Rating: important References: 1137443 Cross-References: CVE-2019-12735 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This update f...

CVE-2019-14258

The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988...

CVE-2019-14258

The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988...

Information disclosure

The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988...

CVE-2019-14258

The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988...

CVE-2019-14258

CVE-2019-14258 affects Zenoss 2.5.3 via the XML-RPC subsystem, where an XXE flaw in XML processing allows unauthenticated information disclosure on port 9988. Root cause is XXE in the XML handling of the XML-RPC subsystem. The impact is unauthenticated disclosure; no exploitation status or practi...

UBUNTU-CVE-2019-15132

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of...

NewStart CGSL MAIN 4.05 : samba4 Vulnerability (NS-SA-2019-0128)

The remote NewStart CGSL host, running version MAIN 4.05, has samba4 packages installed that are affected by a vulnerability: - A null pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash...

NewStart CGSL CORE 5.04 / MAIN 5.04 : samba Multiple Vulnerabilities (NS-SA-2019-0069)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has samba packages installed that are affected by multiple vulnerabilities: - A null pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service...