NewStart CGSL CORE 5.05 / MAIN 5.05 : ipa Multiple Vulnerabilities (NS-SA-2020-0111)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ipa packages installed that are affected by multiple vulnerabilities: - A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA'...

NewStart CGSL CORE 5.04 / MAIN 5.04 : rsyslog Multiple Vulnerabilities (NS-SA-2020-0080)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has rsyslog packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The...

NewStart CGSL CORE 5.05 / MAIN 5.05 : rsyslog Multiple Vulnerabilities (NS-SA-2020-0120)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has rsyslog packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The...

NewStart CGSL CORE 5.05 / MAIN 5.05 : wireshark Multiple Vulnerabilities (NS-SA-2020-0097)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has wireshark packages installed that are affected by multiple vulnerabilities: - In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by...

NewStart CGSL CORE 5.04 / MAIN 5.04 : gnome-shell Vulnerability (NS-SA-2020-0066)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has gnome-shell packages installed that are affected by a vulnerability: - It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical...

Disabled Hostname Verification in Opencast

Opencast before version 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for...

GHSA-44CW-P2HM-GPF6 Disabled Hostname Verification in Opencast

Opencast before version 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for...

Scientific Linux Security Update : firefox on SL6.x i686/x86_64 (2020:5257)

The remote Scientific Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the SLSA-2020:5257-1 advisory. - Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code CVE-2020-26951 - Mozilla: Memory safety bugs...

Kile Self-Media News System Free v1.1.4 has a logic flaw vulnerability

Kile Self-Media News Management System is a news management system based on TP5.1 development. A logic flaw vulnerability exists in Kile Self-Media News System Free v1.1.4, which can be exploited by attackers to obtain sensitive information...

CVE-2020-29137

cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface SEC-577...

CVE-2020-29137

cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface SEC-577...

Design/Logic Flaw

cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface SEC-577...

CVE-2020-29137

CVE-2020-29137 affects cPanel prior to 90.0.17, with a self‑XSS vulnerability in the WHM Transfer Tool interface (SEC-577). The issue is limited to the Transfer Tool’s UI and is triggered by user input that could execute script in the victim’s browser. Exploitation details are not provided in the...

CVE-2020-29137

cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface SEC-577...

cPanel Self-XSS Vulnerability

cPanel is a set of Web-based host control management system of the U.S. cPanel. A self-XSS vulnerability exists in the "WHM Transfer Tool" interface in cPanel versions prior to 90.0.17. No details of the vulnerability are available at this time...

Automattic: [intensedebate.com] SQL Injection Time Based On /js/commentAction/

intensedebate.com SQLi Time Based On /js/commentAction/ Summary: Hello, I have found a SQLI Injection Time Based on /js/commentAction/. When a user want to submit/reply to a comment, a JSON payload was send by a GET request. GET...

Ubuntu 18.04 LTS / 20.04 LTS : WebKitGTK vulnerabilities (USN-4648-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4648-1 advisory. A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a maliciou...

phpMyAdmin 4.3.x < 4.7.8 XSS (PMASA-2018-1)

According to its self-reported version, the phpMyAdmin application hosted on the remote web server is 4.7.x prior to 4.7.8. Versions since 4.3 are also affected, but they are no longer supported. It is, therefore, affected by a cross-site scripting XSS vulnerability in dbcentralcolumns.php. A...

Intel Active Management Technology (AMT) Multiple Vulnerabilities (INTEL-SA-00391) (remote check)

The Intel Management Engine on the remote host has Active Management Technology AMT enabled, and, according to its self-reported, is a version containing multiple vulnerabilities, including the following: - Out-of-bounds write in IPv6 subsystem for IntelR AMT, IntelR ISM versions before 11.8.80,...

Cisco IOS Access Points DoS (cisco-sa-20190717-aironet-dos)

A denial of service DoS vulnerability exists in Cisco IOS Access Points due to a lack of complete error handling condition for client authentication requests sent to a targeted interface configured for FT. An unauthenticated, adjacent attacker can exploit this issue, by sending crafted...