276 matches found
[SECURITY] Fedora 34 Update: gtk4-4.1.2-1.fc34
GTK is a multi-platform toolkit for creating graphical user interfaces. Offering a complete set of widgets, GTK is suitable for projects ranging from small one-off tools to complete application suites. This package contains version 4 of GTK...
Rails Sprockets 2.x < 2.12.5 / 3.x < 3.7.2 / 4.x < 4.0.0.beta8 Path Traversal
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is...
RHEL 7 : kernel-alt (RHSA-2020:2854)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2854 advisory. The kernel-alt packages provide the Linux kernel version 4.x. Security Fixes: kernel: nfs: use-after-free in svcprocesscommon CVE-2018-16884...
[SECURITY] Fedora 33 Update: php-symfony4-4.4.13-1.fc33
Symfony PHP framework version 4. NOTE: Does not require PHPUnit bridge...
QEMU 4.x < 5.0.0 Authentication Bypass Vulnerability
QEMU is prone to an authentication bypass vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...
Emerson WirelessHART Gateway
1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Emerson Equipment: Emerson WirelessHART Gateways 1410, 1420 and 1552WU Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could disable the...
Squid Security Update Advisory (SQUID-2020:4)
Squid is prone to multiple vulnerabilities in the HTTP Digest authentication. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program i...
Release information for Veeam Service Provider Console v4
Requirements Please confirm that you are running version 3 build 3.0.0.2647 or later prior to upgrading. You can check this under Configuration | Support Information in the Veeam Service Provider Console UI. After upgrading, your build number will be 4.0.0.4877. To upgrade from earlier versions,...
Linux: Read /etc/ntp.conf (KB)
The ntpd program is an operating system daemon which sets and maintains the system time of day in synchronism with Internet standard time servers. It is a complete implementation of the Network Time Protocol NTP version 4, but also retains compatibility with version 3, as defined by RFC-1305, and...
[SECURITY] [DLA 2060-1] phpmyadmin security update
Package : phpmyadmin Version : 4:4.2.12-2+deb8u8 CVE ID : CVE-2020-5504 Debian Bug : 948718 In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. ...
CVE-2019-14901
A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability ...
Squid Multiple Security Update Advisories (SQUID-2019:7, SQUID-2019:8, SQUID-2019:10)
Squid is prone to multiple vulnerabilities. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Puppet Enterprise 2017.x < 2017.3.6 Cross-site Scripting Vulnerability
According to its self-reported version number, the Puppet install running on the remote host is version 4.x prior to 2016.2.1, 5.3.x prior to 2017.3.7, or 5.5.x prior to 2018.1.1. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied...
CVE-2019-10168
The virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's...
Squid Security Update Advisory (SQUID-2018:4)
Squid is prone to a cross-site scripting vulnerability to incorrect input handling when generating HTTPS response messages about TLS errors. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...
Squid buffer overflow vulnerability (CNVD-2019-23845)
Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A buffer overflow vulnerability exists in Squid versions 3.3.9 through 3.5.28 and 4.x through 4.7. The vulnerability...
Low: Red Hat Security Advisory: kernel-alt security and bug fix update
An update for kernel-alt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p5 Denial Of Service Vulnerability
The version of the remote NTP server is 3.x or 4.x prior to 4.2.8p5. It is, therefore, affected by the following vulnerability : - he panicgate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows...
websockets is vulnerable to denial of service by memory exhaustion
The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable...