SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2018:2649-2)

This update for java-171-ibm fixes the following issues : Security issues fixed : CVE-2018-1517: Fixed a flaw in the java.math component in IBM SDK, which may allow an attacker to inflict a denial-of-service attack with specially crafted String data. CVE-2018-1656: Protect against path traversal...

SUSE-SU-2018:2649-2 Security update for java-1_7_1-ibm

This update for java-171-ibm fixes the following issues: Security issues fixed: - CVE-2018-1517: Fixed a flaw in the java.math component in IBM SDK, which may allow an attacker to inflict a denial-of-service attack with specially crafted String data. - CVE-2018-1656: Protect against path traversa...

SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2018:2649-1)

This update for java-171-ibm fixes the following issues : Security issues fixed : CVE-2018-1517: Fixed a flaw in the java.math component in IBM SDK, which may allow an attacker to inflict a denial-of-service attack with specially crafted String data. CVE-2018-1656: Protect against path traversal...

SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2018:2574-1)

This update for java-170-ibm fixes the following issues : Security issues fixed : CVE-2018-1517: Fixed a flaw in the java.math component in IBM SDK, which may allow an attacker to inflict a denial-of-service attack with specially crafted String data. CVE-2018-1656: Protect against path traversal...

NoSQL Injection

Overview Versions of loopback-connector-mongodb before 3.6.0 are vulnerable to NoSQL injection. MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous $where property to be passed to the MongoDB Driver. The Driver allows the speci...

GHSA-Q5C4-39F5-M68J Regular Expression Denial of Service in decamelize

Affected versions of decamelize are susceptible to a denial of service vulnerability when user input is passed directly into decamelize. Recommendation Update to version 1.1.2 or later...

GHSA-FF6R-5JWM-8292 Regular Expression Denial of Service in no-case

Affected versions of no-case are vulnerable to a regular expression denial of service when parsing untrusted user input. Recommendation Update to version 2.3.2 or later...

PT-2018-17708 · Mcafee · Mcafee Web Gateway

Name of the Vulnerable Software and Affected Versions: McAfee Web Gateway versions 7.8.1.x Description: A Directory Traversal issue in the administrative user interface allows authenticated administrator users to gain elevated privileges via unspecified vectors. Recommendations: For McAfee Web...

GHSA-WRVR-8MPX-R7PP mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input

Affected versions of mime are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input. Recommendation Update to version 2.0.3 or later...

PT-2019-4775

Name of the Vulnerable Software and Affected Versions Python versions 2.7.16 and earlier Python versions 3.x through 3.5.7 Python versions 3.6.x through 3.6.9 Python versions 3.7.x through 3.7.4 Description The issue is related to the email module in Python, which incorrectly parses email address...

PT-2018-3303 · Mutt +5 · Mutt +5

Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.10.1 NeoMutt versions prior to 2018-07-16 Description: The issue is related to a stack-based buffer overflow in the imap/message.c file of the Mutt and NeoMutt email clients. This overflow occurs when handling a FETCH...

PT-2018-3299 · Mutt +5 · Mutt +5

Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.10.1 NeoMutt versions prior to 2018-07-16 Description: An issue was discovered in the imap quote string function of the imap/util.c file in Mutt and NeoMutt email clients. The issue is related to an integer underflow...

DHC Online Shop App for Android fails to verify SSL server certificates

Overview DHC Online Shop App for Android provided by DHC Corporation fails to verify SSL server certificates. Sho Ueshima and Tsuyoshi Ogawa of SIE Co.,Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

PT-2018-2560 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.17.7 Description: The issue exists due to insufficient input validation in the yurex USB driver, specifically in the yurex read function within the drivers/usb/misc/yurex.c file. This can be exploited by local...

MGASA-2018-0302 Updated webkit2 packages fix security vulnerability

The webkit2 package has been updated to version 2.20.3, fixing several security issues and other bugs...

PT-2018-10637 · Woocommerce · Advanced Order Export For Woocommerce

Name of the Vulnerable Software and Affected Versions: Advanced Order Export For WooCommerce versions 1.5.4 and earlier Description: The issue concerns a CSV Injection vulnerability. Recommendations: For versions 1.5.4 and earlier, update to a version later than 1.5.4 to resolve the issue...

PT-2018-1938

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.8.0 through 4.8.1 Description An issue was discovered in phpMyAdmin where an attacker can include and potentially execute files on the server due to improper testing for whitelisted pages during page redirection and loadi...

SUSE-SU-2018:1661-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: Update to version 20180425 bsc1091836 Fix provided for: - GLK B0 6-7a-1/01 0000001e-00000022 Pentium Silver N/J5xxx, Celeron N/J4xxx - Name microcodes which are not allowed to load late with a .early suffix...

PT-2018-6057

Name of the Vulnerable Software and Affected Versions: Request versions 2.2.6 through 2.46.9 Request versions 2.51.0 through 2.67.0 Description: The issue affects the Request library when a multipart request is made and the body type is a number. In such cases, a buffer of the specified size is...

PT-2018-2073 · D Link · D-Link Central Wifi Manager

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFi Manager versions prior to 1.03r0100-Beta1 Description: The issue exists due to the lack of protection for the web page structure in the UpdateSite function of the D-Link Central WiFi Manager. This allows a remote attacker ...