PT-2019-16843 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1 Description: The issue is a buffer overflow that could allow an authenticated local attacker to execute arbitrary code on the system as root...

WinRAR <= 5.60 Out-of-Bounds Write Vulnerability

WinRAR is prone to an Out-of-Bounds Write vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

azure-umqtt-c vulnerable to denial-of-service (DoS)

Overview azure-umqtt-c contains a denial-of-service DoS vulnerability CWE-400. Masataka Sakaguchi, Bintatsu Noda and Hisashi Kojima of FUJITSU LABORATORIES LTD. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...

GHSA-856X-CP3Q-47VG Insecure Default Configuration in airbrake

Affected versions of airbrake default to sending environment variables over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible for them to capture and read these environment variables, which may result in leaking sensitive information...

@descartes/d-editmap (=6.0.0), @descartes/d-geoplateforme (=6.0.0-RC2) +87 more potentially affected by CVE-2016-10583 via closure-util (>=1.15.1 <=1.26.0)

closure-util NPM version =1.15.1, =1.36.0, =0.0.1, =3.6.0, =1.0.0, =0.1.0, =0.3.0, =0.9.0, =0.1.0, =9.0.0, =1.20.2, =2.1.0 and more Source cves: CVE-2016-10583 Source advisory: OSV:GHSA-2HPJ-G53M-9GJ6...

Apache Traffic Server (ATS) sslheader Plugin Vulnerability

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Photon OS 2.0: Libgcrypt PHSA-2018-2.0-0091

An update of the libgcrypt package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0091. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2019-11316 · Jenkins · Jenkins Gitlab Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitHub Authentication Plugin versions 0.29 and earlier Description: An exposure of sensitive information issue exists that allows attackers, who can view a Jenkins administrator's web browser output or control the browser, to retrieve...

Open-Xchange (OX) App Suite XSS Vulnerability (59653)

Attachment file names in mail can be used to inject script code, in case the victim uses Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later Thi...

KLA11408 Multiple vulnerabilities in Apple iTunes

Multiple vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code, perform cross-site scripting attack. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability i...

PT-2019-6312

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 5.4.0 through 5.6.7 Fortinet FortiOS version 6.0.2 Fortinet FortiADC versions 5.4.0 through 5.4.4 Fortinet FortiADC versions 6.0.0 through 6.0.1 Fortinet FortiADC version 6.1.0 Description: An improper access control...

Joomla! Extension 'JCK Suite' - 'jckeditor' =< 6.4.4 Privilege Escalation

The Joomla! application running on the remote host has a version of 'JCK Suite' - 'jckeditor' extension that is prior or equal to 6.4.4. As such, the host is affected by a SQL injection SQLi vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacke...

PT-2019-5811 · Red Hat +1 · Red Hat +2

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Linux versions since v219-62.2 Description: A memory leak was discovered in the backport of fixes in Red Hat Enterprise Linux. The function dispatch message real in journald-server.c does not free the memory allocated by se...

PT-2019-1115 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 4.19.13 Description: The issue is related to the mincore function in the Linux kernel, which lacks protection of internal data. This could allow an attacker to disclose protected information by observing page cac...

Apache CouchDB < 2.3.0 Remote Privilege Escalation Vulnerability - Windows

CouchDB is prone to a remote privilege escalation vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:couchdb";...

PT-2018-15156 · Razorcms · Razorcms

Name of the Vulnerable Software and Affected Versions: razorCMS version 3.4.8 Description: A stored XSS issue exists, allowing potential exploitation via the //page API endpoint, specifically through the description parameter. Recommendations: For razorCMS version 3.4.8, update to a version that...

PT-2018-15303 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs versions prior to 0.11.82.1218 Description: A directory traversal issue exists in the file-upload functionality, allowing an attacker to create a file under data/sessions on the server. Recommendations: For versions prior to 0.11.82.1218...

Mozilla Firefox Security Advisories (MFSA2018-28, MFSA2018-30) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

KLA11384 Multiple vulnerabilities in Apple iTunes

Multiple vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Multiple vulnerabilities can be exploited remotely to spoof user interface; 2. Multiple memory...

Apache Hadoop < 2.7.7 Privilege Escalation Vulnerability

In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrigh...