openSUSE Security Update : otrs (openSUSE-2019-973)

This update for otrs fixes the following issues : Update to version 4.0.33. Security issues fixed : - CVE-2018-19141: Fixed privilege escalation, that an attacker who is logged into OTRS as an admin user cannot manipulate the URL to cause execution of JavaScript in the context of OTRS. -...

Cross site scripting

Moxa G3100V2 Series, editions prior to Version 2.8, and OnCell G3111/G3151/G3211/G3251 Series, editions prior to Version 1.7 allows a reflected cross-site scripting attack which may allow an attacker to execute arbitrary script code in the user’s browser within the trust relationship between thei...

PHP 7.0.x < 7.0.23 Heap-based Buffer Overflow Vulnerability

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.23. It is, therefore, affected by a heap-based buffer overflow condition exists in the ext/standard/varunserializer.re script due to improper use of the hash API for key deletion. An unauthenticated...

CVE-2018-18992

LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server...

CVE-2019-6799

Summary of CVE-2019-6799 (phpMyAdmin) Affected: phpMyAdmin before 4.8.5. The issue arises when the AllowArbitraryServer setting is true and a rogue MySQL server is used. The vulnerability allows an attacker to read arbitrary files on the server that the web server user can access. It is related t...

CVE-2019-2486

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

CVE-2019-2532

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

CVE-2019-2533

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server : Security : Privileges. Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Serve...

CVE-2019-2533: Undefined Security Weakness

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server : Security : Privileges. Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Serve...

CVE-2019-2486: Undefined Security Weakness

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

PT-2019-1331

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 5.7.24 and prior Oracle MySQL versions 8.0.13 and prior Description The issue is related to insufficient access control in the MySQL Server component, specifically in the Server: Security: Privileges subcomponent. This...

PT-2019-1332 · Oracle +7 · Mysql Server +6

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 5.7.24 and prior Oracle MySQL versions 8.0.13 and prior Description: The issue is related to insufficient access control in the MySQL Server component, specifically in the Server: Security: Privileges subcomponent. This...

KB4480966: Windows 10 Version 1803 and Windows Server Version 1803 January 2019 Security Update

The remote Windows host is missing security update 4480966. It is, therefore, affected by multiple vulnerabilities : - A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client. An attacker who successfully exploited th...

Town of Salem Data Breach Exposes 7.6 Million Gamers' Accounts

A massive data breach at the popular online role-playing game 'Town of Salem' has reportedly impacted more than 7.6 million players, the game owner BlankMediaGames BMG confirmed Wednesday on its online forum. With the user base of more than 8 million players, Town of Salem is a browser-based game...

CVE-2018-16555

A vulnerability has been identified in SCALANCE S602 All versions V4.0.1.1, SCALANCE S612 All versions V4.0.1.1, SCALANCE S623 All versions V4.0.1.1, SCALANCE S627-2M All versions V4.0.1.1. The integrated web server could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked in...

Amazon Linux AMI : postgresql95 (ALAS-2018-1118)

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side...

CVE-2018-19791

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substri...

CVE-2018-7807

Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could...

CVE-2018-19458

PHP Proxy 3.0.3 is vulnerable to Local File Inclusion via index.php?q=file:///, allowing unauthenticated reading of server files (CVE-2018-19458). The Nuclei template confirms LFI in PHP Proxy 3.0.3 and cites unauthenticated access. Impact as described: read arbitrary files on the server; exploit...

CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery / Cross-Site Scripting

Title: CentOS Web Panel Root Account Takeover + Remote Command Execution var url = "http://targetserver:2030/admin/index.php?module=rootpwd"; var params = "ifpost=yes&password1=newpassword&password2=newpassword"; var vuln = new XMLHttpRequest; vuln.open"POST", url, true; vuln.withCredentials =...