CVE-2020-25686 affecting package dnsmasq 2.79-11

CVE-2020-25686 affecting package dnsmasq 2.79-11. An upgraded version of the package is available that resolves this issue...

CVE-2005-2069 affecting package openldap 2.4.50-1

CVE-2005-2069 affecting package openldap 2.4.50-1. An upgraded version of the package is available that resolves this issue...

Security Bulletin: IBM Security Verify Information Queue uses a Node.js package with a cross-site scripting vulnerability (CVE-2020-7676)

Summary The web server in IBM Security Verify Information Queue ISIQ uses an older version of the angular.js package that has a cross-site scripting vulnerability. As of v10.0.0, ISIQ has upgraded to a newer, secure version of angular.js. Vulnerability Details CVEID: CVE-2020-7676 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities in GNU binutils affect IBM Netezza Analytics

Summary GNU binutils is used by IBM Netezza Analytics. IBM Netezza Analytics has addressed the applicable CVEs by upgrading GNU binutils to latest version 2.35. Vulnerability Details CVEID: CVE-2020-35495 DESCRIPTION: GNU Binutils is vulnerable to a denial of service, caused by NULL pointer...

ALSA-2020:5620 Important: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream version: postgresql 12.5. Security Fixes: postgresql: Reconnection can downgrade connection security settings CVE-2020-25694 postgresql: Multiple features...

Moderate: Red Hat Security Advisory: rh-eclipse security, bug fix and enhancement update

Updated rh-eclipse packages are now available as a part of Red Hat Developer Tools for Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Cross-Site Scripting in scratch-svg-renderer

Overview This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function. Recommendation Upgrade to version...

Man-in-the-middle (MitM)

Firefox is vulnerable to man-in-the-middle MitM. The Upgrade-Insecure-Requests UIR specification states that if UIR is enabled through Content Security Policy CSP, navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the...

Cross-Site Scripting in react

Affected versions of react are vulnerable to Cross-Site Scripting XSS. The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input. Recommendation If you are using react 0.5.x, upgrade to version...

libetpan: Improper STARTTLS handling

Background libetpan is a portable, efficient middleware for different kinds of mail access. Description It was discovered that libetpan was not properly handling state within the STARTTLS protocol handshake. Impact There may be a breach of integrity or confidentiality in connections made using...

Command Injection in Kylin

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: Rational Integration Tester HTTP/TCP Proxy component in Rational Test Virtualization Server and Rational Test Workbench affected by Netty vulnerabilities (CVE-2020-7238, CVE-2019-16869, CVE-2019-20445, CVE-2019-20444)

Summary Netty is vulnerable to security issues affecting the Rational Integration Tester HTTP/TCP Proxy component in Rational Test Virtualization Server and Rational Test Workbench Vulnerability Details CVEID: CVE-2020-7238 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a...

UBUNTU-CVE-2020-1938

When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that...

PT-2020-20200 · Phplist · Phplist

Name of the Vulnerable Software and Affected Versions: phpList version 3.5.0 Description: The issue allows for admin login bypass due to type juggling. This occurs because the code uses == for password hash comparison instead of ===, which can mishandle hashes starting with 0e followed by numeric...

RHEL 7 : firefox (RHSA-2020:0085)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0085 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Debian: Security Advisory (DSA-4585-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Privilege Escalation

Overview Versions of strapi prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token. Recommendation Upgrade to version 3.0.0-beta.17.5 or later...

CVE-2017-18402

cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade SEC-336...

CVE-2018-11772

Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node if any was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires adm...