openSUSE Security Update : xdg-utils (openSUSE-2019-420)

This update for xdg-utils fixes this security issues : - CVE-2017-18266: The openenvvar function in xdg-open did not validate strings launching the program specified by the BROWSER environment variable, which might allowed remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2019-10061: Improper Neutralization of Special Elements used in an OS Command

utils/find-opencv.js in node-opencv aka OpenCV bindings for Node.js prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands...

EulerOS Virtualization 2.5.2 : yum-utils (EulerOS-SA-2019-1080)

According to the version of the yum-utils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repositor...

Remote Code Execution (RCE)

node-os-utils is vulnerable to remote code execution RCE. The attack exists because it does not properly handle the user inputs, allowing the attacker to inject malicious code...

Remote Code Execution

Overview Versions of node-os-utils prior to 1.1.0 are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution. Recommendation Upgrade to version 1.1.0 or later...

Up (Ultimate Plumber) - Tool For Writing Linux Pipes With Instant Live Preview

up is the Ultimate Plumber , a tool for writing Linux pipes in a terminal-based UI interactively, with instant live preview of command results. The main goal of the Ultimate Plumber is to help interactively and incrementally explore textual data in Linux, by making it easier to quickly build...

PYSEC-2019-88

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format function...

DEBIAN-CVE-2019-6459

An issue was discovered in GNU Recutils 1.8. There is a memory leak in recextracttype in rec-utils.c in librec.a...

Directory Traversal

redhat-virtualization-host is vulnerable to directory traversal attacks. The vulnerability exists as a directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they...

Information Disclosure Through Date Template Filter

Django is vulnerable to information disclosure. This vulnerability is caused in the getformat function in utils/formats.py which allows a malicious user to obtain any secret in the application settings by specifying a settings key name instead of a date format...

Information Disclosure

The cifs-utils package is vulnerable to information disclosure. The vulnerability exists due to the way it handles the second argument in mount.cifs which allows a local user to disclose the arbitrary file or directory information via an error massage...

CVE-2019-5893: Improper Neutralization of Special Elements used in an SQL Command

Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter...

@yaochuxia/roadhog (1.0.9), svmx-react-scripts (>=1.1.4, <=1.1.17) +1 more potentially affected by CVE-2018-6342 via react-dev-utils (2.0.1)

react-dev-utils NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on react-dev-utils and may be impacted: - @yaochuxia/roadhog 1.0.9 - svmx-react-scripts =1.1.4, =0.1.0, =0.1.1 Source cves: CVE-2018-6342 Source advisory:...

@enact/cli (>=0.9.6, <=0.9.8), abt.api.web (0.0.3) +28 more potentially affected by CVE-2018-6342 via react-dev-utils (>=3.0.0, <=3.1.1)

react-dev-utils NPM version =3.0.0, =0.9.6, =4.2.0, =1.5.1, =0.15.0, =0.7.0, =0.7.0, =0.1.0, =0.1.4, =1.9.2, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2018-6342 Source advisory: OSV:GHSA-29GP-92WP-94Q8...

react-error-overlay (>=1.0.0-alpha.02968ecd, <=1.0.0-alpha.55afd862), react-scripts (>=1.0.0-alpha.02968ecd, <=1.0.0-alpha.55afd862) potentially affected by CVE-2018-6342 via react-dev-utils (1.0.0-alpha.02968ecd)

react-dev-utils NPM version 1.0.0-alpha.02968ecd is affected by a known vulnerability. The following packages have a transitive dependency on react-dev-utils and may be impacted: - react-error-overlay =1.0.0-alpha.02968ecd, =1.0.0-alpha.02968ecd, =1.0.0-alpha.55afd862 Source cves: CVE-2018-6342...

@1337lawyers/design (>=0.1.0, <=0.1.38), @9188/w-cli (>=1.0.0, <=1.0.4) +50 more potentially affected by CVE-2018-6342 via react-dev-utils (>=5.0.0, <=5.0.1)

react-dev-utils NPM version =5.0.0, =0.1.0, =1.0.0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.5, =1.0.0-beta.28, =1.0.1, =1.0.0, =1.0.0, =0.26.4, =0.0.0-legacy, =3.10.0-beta.0, =0.1.0-alpha.0, =2.1.16, =2.3.5 - aqxy-common-ui 0.0.1 and more Source cves: CVE-2018-6342 Source advisory:...

GHSA-29GP-92WP-94Q8 react-dev-utils on Windows vulnerable to Remote Code Execution

react-dev-utils on Windows is vulnerable to remote code execution. Recommendation Update to one of the following versions, depending on the release line that you are using. - 1.0.4 - 2.0.2 - 3.1.2 - 4.2.2 - 5.0.2 - 6.0.0-next.a671462c...

@5minutes2start/react-scripts (>=1.1.2, <=1.1.4), @biko/react-scripts (>=0.1.0, <=0.4.0) +132 more potentially affected by CVE-2018-6342 via react-dev-utils (>=4.0.0, <=4.2.1)

react-dev-utils NPM version =4.0.0, =1.1.2, =0.1.0, =0.8.12, =0.1.0, =0.0.1, =2.13.0, =2.14.0, =0.2.0, =0.3.0, =0.2.2, =0.2.10-SNAPSHOT.481, =0.2.10-SNAPSHOT.673 - @leizeng/react-scripts-ts 2.13.0 and more Source cves: CVE-2018-6342 Source advisory: OSV:GHSA-29GP-92WP-94Q8...

react-dev-utils on Windows vulnerable to Remote Code Execution

react-dev-utils on Windows is vulnerable to remote code execution. Recommendation Update to one of the following versions, depending on the release line that you are using. - 1.0.4 - 2.0.2 - 3.1.2 - 4.2.2 - 5.0.2 - 6.0.0-next.a671462c...

Fedora 28 : xdg-utils (2018-efd98d9a58)

New upstream bugfix release, includes security fix for CVE-2017-18266 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...