Security update for qemu (moderate)

This update for qemu fixes the following issues: This security issue was fixed: - CVE-2018-12617: qmpguestfileread had an integer overflow that could have been exploited by sending a crafted QMP command including guest-file-read with a large count value to the agent via the listening socket causi...

Vulnerability Spotlight: TALOS-2018-0560 - ERPNext SQL Injection Vulnerabilities

Vulnerabilities discovered by Yuri Kramar from the Cisco Security Advisor Team Overview Talos is disclosing multiple SQL injection vulnerabilities in the Frappe ERPNext Version 10.1.6 application. Frappe ERPNext is an open-source enterprise resource planning ERP cloud application. These...

UBUNTU-CVE-2018-16384

A SQL injection bypass aka PL1 bypass exists in OWASP ModSecurity Core Rule Set owasp-modsecurity-crs through v3.1.0-rc3 via ab where a is a special function name such as "if" and b is the SQL statement to be executed...

DEBIAN-CVE-2018-16384

A SQL injection bypass aka PL1 bypass exists in OWASP ModSecurity Core Rule Set owasp-modsecurity-crs through v3.1.0-rc3 via ab where a is a special function name such as "if" and b is the SQL statement to be executed...

CVE-2018-16384

A SQL injection bypass aka PL1 bypass exists in OWASP ModSecurity Core Rule Set owasp-modsecurity-crs through v3.1.0-rc3 via ab where a is a special function name such as "if" and b is the SQL statement to be executed...

CVE-2018-16384: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection bypass aka PL1 bypass exists in OWASP ModSecurity Core Rule Set owasp-modsecurity-crs through v3.1.0-rc3 via ab where a is a special function name such as "if" and b is the SQL statement to be executed...

CVE-2018-16384

CVE-2018-16384 describes a SQL injection bypass in the OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) via a crafted payload {ab}, where a is a function name (e.g., if) and b is the SQL to execute. Public details reference CRS versions up to 3.1.0-rc3, with later advisories noting related...

PT-2018-13536 · Owasp · Owasp Modsecurity Core Rule Set

Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set versions prior to 3.1.0-rc4 Description: A SQL injection bypass issue exists, allowing attackers to bypass security controls. This is achieved by using a special syntax ab, where a is a special function name,...

CVE-2018-16384

A SQL injection bypass aka PL1 bypass exists in OWASP ModSecurity Core Rule Set owasp-modsecurity-crs through v3.1.0-rc3 via ab where a is a special function name such as "if" and b is the SQL statement to be executed...

August 30, 2018—KB4343889 (OS Build 15063.1292)

None None...

CVE-2018-15904: Improper Neutralization of Special Elements used in an SQL Command

A10 ACOS Web Application Firewall WAF 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before 4.1.0-P11, 4.1.1 before 4.1.1-P8, and 4.1.2 before 4.1.2-P4 mishandles the configured rules for blocking SQL injection attacks, aka A10-2017-0008...

Apache Struts Vulnerability CVE-2018-11776

On Wednesday, August 22nd, the Apache team patched another vulnerability in the Apache Struts2 framework. Apache Struts is an open-source web application framework for developing Java web applications. The vulnerability exists when these conditions are met: 1. The alwaysSelectFullNamespace flag...

Microsoft Windows Firewall: Domain: Inbound connections

This setting determines the behavior for inbound connections that do not match an inbound firewall rule. C Microsoft Corporation 2015. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Microsoft Windows Firewall: Domain: Outbound connections

This setting determines the behavior for outbound connections that do not match an outbound firewall rule. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PT-2018-2705

Name of the Vulnerable Software and Affected Versions Open vSwitch OvS versions 2.7.x through 2.7.6 Description The issue is related to errors in rule checking when handling flows, which can cause a crash in Open vSwitch OvS. This can be exploited by a remote attacker to cause a denial of service...

The vulnerability of the DNS server testing tool dnslint lies in its lack of protection for website structure, allowing attackers to execute arbitrary code.

The vulnerability of the DNS server testing tool dnslint exists because measures are not taken to protect the structure of web pages when generating reports. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted file that defines the rules for...

CVE-2017-12175

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality...

Design/Logic Flaw

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality...

CVE-2017-12175

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality...

CVE-2017-12175

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality...