DEBIAN-CVE-2019-20184

KeePass 2.4.1 allows CSV injection in the title field of a CSV export...

UBUNTU-CVE-2019-20184

KeePass 2.4.1 allows CSV injection in the title field of a CSV export...

GHSA-GF8J-V8X5-H9QP XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript:alert substring...

NewStart CGSL CORE 5.04 / MAIN 5.04 : 389-ds-base Vulnerability (NS-SA-2019-0261)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has 389-ds-base packages installed that are affected by a vulnerability: - A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, th...

zookeeper: Information disclosure in Apache ZooKeeper

A flaw was found in Apache ZooKeeper. A lack of permission checks while retrieving ACLs allows unsalted hash values to be disclosed for unauthenticated or unprivileged users...

CVE-2019-13181

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7...

Serv-U FTP Server CSV Injection Vulnerability

Serv-U is an award-winning FTP server software developed by Rob Beckers, full name: Serv-U FTP Server. FTP server users can share files on the internet through it using the FTP protocol. Serv-U FTP Server suffers from a CSV injection vulnerability that can be exploited by an attacker with the...

CVE-2019-0403

SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection...

Unspecified Vulnerability in IBM Cloud Pak System Platform System Manager

IBM Cloud Pak System is a complete stack converged infrastructure from IBM USA. The product provides a virtualized cloud operating environment for applications. A CVS injection vulnerability exists in Platform System Manager in IBM Cloud Pak System versions 2.3 through 2.3.0.1, which stems from t...

python-jinja2: Sandbox escape due to information disclosure via str.format

A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity a...

Debian DLA-2004-1 : 389-ds-base security update

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes. For Debian 8 'Jessie', this problem has been fixed ...

CVE-2019-5232

There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote attacker can guess information by a large number of attempts. Successful exploitation may cause information leak...

CVE-2019-5232

There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote attacker can guess information by a large number of attempts. Successful exploitation may cause information leak...

CVE-2019-5232

CVE-2019-5232 affects Huawei ViewPoint products due to use of insufficiently random values. An unauthenticated, remote attacker can perform repeated guessing attempts, leading to information leakage. Affected component is the ViewPoint implementation in Huawei devices; root cause is weak randomne...

python-jinja2: Sandbox escape due to information disclosure via str.format

A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity a...

DEBIAN-CVE-2019-19039

btrfsfreeextent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfsprintleaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as no...

UBUNTU-CVE-2019-19039

btrfsfreeextent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfsprintleaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as no...

Huawei VP9630, VP9650 and VP9660 Use of Insufficient Random Values Vulnerability

Huawei VP9630 is a multimedia switching device mainly used for video conferencing from Huawei, China. A security vulnerability exists in the Huawei VP9630, VP9650, and VP9660. A remote attacker could exploit the vulnerability to obtain information...

Linux kernel information disclosure vulnerability (CNVD-2019-42534)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. An information disclosure vulnerability exists in Linux kernel 5.3.12 and earlier versions. The vulnerability stems...

CVE-2019-6187

A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller XCC that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV...