10097 matches found
CVE-2019-7617
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...
Design/Logic Flaw
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...
CVE-2019-7617
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...
SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2019:2191-1)
This update for wavpack fixes the following issues : Security issues fixed : CVE-2019-1010319: Fixed use of uninitialized variable in ParseWave64HeaderConfig that can result in unexpected control flow, crashes, and segfaults bsc1141334. CVE-2019-11498: Fixed possible denial of service application...
CVE-2019-14257
pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropped, aka ZEN-31765...
Privilege escalation
pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropped, aka ZEN-31765...
Arbitrary Code Execution
php is vulnerable to arbitrary code execution. An integer underflow in the gdContributionsAlloc function in gdinterpolation.c allows remote attackers to execute arbitrary code in the system by decrementing the u variable...
gd: Information disclosure in gdImageCreateFromXbm()
When using the gdImageCreateFromXbm function in the GD Graphics Library aka LibGD 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized...
Humanica Humatrix 7 Recruitment Module Information Disclosure Vulnerability
Humanica Humatrix 7 is a human resource management solution. recruitment is one of the recruitment modules. A security vulnerability exists in the Recruitment module in Humanica Humatrix 7 versions 1.0.0.681 and 1.0.0.203. A remote attacker can exploit the vulnerability by modifying the 'selApp'...
Debian DLA-1883-1 : tomcat8 security update (httpoxy)
Several minor issues have been fixed in tomcat8, a Java Servlet and JSP engine. CVE-2016-5388 Apache Tomcat, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variabl...
CVE-2019-14932
The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203 allows remote attackers to access all candidates' information on the website via a modified selApp variable to personalData/resumeDetail.cfm. This includes personal information and other sensitive data...
cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment
A credential-protection flaw was found in cockpit-ovirt. During deployment, it generated an ansible variable file /var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var which contained both admin and appliance passwords as plain-text. Although these files are deleted at the end of th...
Moderate: Red Hat Security Advisory: cockpit-ovirt security, bug fix, and enhancement update
An update for cockpit-ovirt is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2019-1010317
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig caff.c:486. The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit...
CVE-2019-1010319
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig wave64.c:211. The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit...
CVE-2017-18415
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering SEC-302...
Code injection
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering SEC-302...
CVE-2017-18415
CVE-2017-18415 affects cPanel prior to 67.9999.103. The issue is an incorrect environment-variable filtering vulnerability that allows code execution in the context of the mailman account (SEC-302). Root cause: improper handling of environment variables in the affected code path. Impact per refer...