Cross site request forgery (csrf)

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery CSRF vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an...

CVE-2021-29436 Cross site request forgery vulnerability

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery CSRF vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an...

CVE-2021-29436

CVE-2021-29436 affects Anuko Time Tracker (PHP, web-based). Before version 1.19.27.5431 a Cross-Site Request Forgery (CSRF) vulnerability allowed a logged-in user to be tricked into performing unintended actions (e.g., changing a password) via a forged request. The issue is fixed in Time Tracker ...

Anuko Time Tracker 跨站请求伪造漏洞

Anuko Time Tracker is a web platform used by the individual developers of Anuko to count employee time spent on projects. A security vulnerability exists in Anuko Time Tracker, which can be exploited to provide a form that can be used by an attacker to perform an unexpected action, such as changi...

Debian DLA-2622-1 : python-django security update

It was discovered that there was a potential directory traversal issue in Django, a Python-based web development framework. The vulnerability could have been exploited by maliciously crafted filenames. However, the upload handlers built into Django itself were not affected. For Debian 9 'Stretch'...

[SECURITY] [DLA 2622-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2622-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb April 09, 2021 https://wiki.debian.org/LTS -...

Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Sourcing

Summary Multiple Oracle database server security vulnerabilities affect IBM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2021-2045 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Text component could allow an authenticated attacker to cause a denial of...

Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt

Summary Multiple Oracle database server security vulnerabilities affect IBM Emptoris Supplier Lifecycle Management. Vulnerability Details CVEID: CVE-2021-2045 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Text component could allow an authenticated attacker to...

Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Program Management

Summary Multiple Oracle Database server security vulnerabilities affect IBM IBM Emptoris Program Management. Vulnerability Details CVEID: CVE-2021-2045 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Text component could allow an authenticated attacker to cause ...

Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Contract Management

Summary Multiple Oracle database server security vulnerabilities affect IBM Emptoris Contract Management. Vulnerability Details CVEID: CVE-2021-2045 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Text component could allow an authenticated attacker to cause a...

[SECURITY] [DLA 2617-1] php-nette security update

Debian LTS Advisory DLA-2617-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany April 04, 2021 https://wiki.debian.org/LTS Package : php-nette Version : 2.4-20160731-1+deb9u1 CVE ID : CVE-2020-15227 Cyku Hong from DEVCORE discovered that php-nette, a PHP MVC...

Debian DSA-4883-1 : underscore - security update

It was discovered that missing input sanitising in the template function of the Underscore JavaScript library could result in the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DLA-2611-1 : ldb security update

Two issues have been found in ldb, an LDAP-like embedded database, for example used with samba. Both issues are related to out of bounds access, either an out of bound read or a heap corrupton, both most likely leading to an application crash. For Debian 9 stretch, these problems have been fixed ...

Debian DLA-2612-1 : leptonlib security update

Several issues have been found by ClusterFuzz in leptonlib, an image processing library. All issues are related to heap-based buffer over-read in several functions or a denial of service application crash with crafted data. For Debian 9 stretch, these problems have been fixed in version...

[SECURITY] [DLA 2612-1] leptonlib security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2612-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz March 31, 2021 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 4877-1] webkit2gtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4877-1 [email protected] https://www.debian.org/security/ Alberto Garcia March 27, 2021 https://www.debian.org/security/faq -...

Debian DLA-2606-1 : lxml security update

An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute. For Debian 9 stretch, this problem has been fixed in version 3.7.1-1+deb9u4. We recommend that you upgrade your lxml...

Debian DLA-2608-1 : jquery security update

Two vulnerabilities have been discovered in jquery's handling of untrusted HTML which may result in execution of untrusted code. For Debian 9 stretch, these problems have been fixed in version 3.1.1-2+deb9u2. We recommend that you upgrade your jquery packages. For the detailed security status of...

Debian DLA-2607-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or spoofing attacks. For Debian 9 stretch, these problems have been fixed in version 78.9.0esr-1deb9u1. We recommend that you...

Kagemai 跨站脚本漏洞

SourceForge Organization kagemai is an application of the Japanese open source SourceForge Organization . A Web-based bug tracking system BTS. Kagemai 0.8.6 suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary script in a user's web browser...