GHSA-J44V-MMF2-XVM9 PDM Trojan Lockfile

Summary It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. Details Project foo can be targeted by creating the project foo-2 and uploading the fil...

CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CWA HTML5 shows incorrect version

After upgrading CWA HTML5 from v2101 to any later versionsE.g. v2309 in the storefront server, the About dialog still shows the old version. The Storefront Console however still shows the correct version...

CVE-2022-34471

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This...

[Citrix Gateway] Client plugin of Window upgrade fails due to upgrade package issue

The client plugin fails to upgrade to the new one after upgrade ADC, following logs sample could be found in client plugin logs 15:36:32.432 | DEBUG | nsStartSSL called 15:36:32.432 | DEBUG | mNotifier0 15:36:32.447 | EVENT | Version mismatch 15:36:32.447 | DEBUG | RedrawActiveXWnd: 6:0...

UBUNTU-CVE-2021-43616

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have bee...

Code injection

The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 https://access.redhat.com/errata/RHBA-2020:0053 included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in...

SUSE SLES12 Security Update : python3 (SUSE-SU-2020:0854-1)

This update for python3 fixes the following issue : CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen. Now an InvalidURL exception is raised bsc1155094. CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. CVE-2020-8492: Fix...

SUSE-SU-2020:0854-1 Security update for python3

This update for python3 fixes the following issue: - CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen. Now an InvalidURL exception is raised bsc1155094. - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs bsc1162825. - CVE-2020-8492...

[SECURITY] [DLA 2116-1] libpam-radius-auth security update

Package : libpam-radius-auth Version : 1.3.16-4.4+deb8u1 CVE ID : CVE-2015-9542 Debian Bug : 951396 A vulnerability was found in pamradius: the password length check was done incorrectly in the addpassword function in pamradiusauth.c, resulting in a stack based buffer overflow. This could be used...

CVE-2019-6470

There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All...

Error: "Wrong database version is being used" After Upgrading Provisioning Server

The following error is displayed after upgrading Provisioning Server: The wrong database version is being used. Found version: 40 Expected version number: 60...

After replacing the license file, you get warnings about a “Grace Period” to renew the license in 4000 days

Challenge This article covers an issue which impacts the following versions differently, but is caused by the same issue. Veeam Backup & Replication 7 Veeam Backup & Replication 8 and 9 ─ ───────────────────────────────────────────────────────── Veeam Backup & Replication 7 ─...

CVE-2009-5026

The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments...

flash-plugin: crash caused by SWF files with different SWF versions obtained from the same URL

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service NULL pointer dereference and browser crash by returning a different response when an HTTP request is sent a second time, as demonstrated by two...

Bluo CMS 1.2 (index.php id) Blind SQL Injection Vulnerability

No description provided by source. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + Bluo cms 1.2 blind sql injection Vulnerability + + Discovered by : The5p3ctrum + Contact AUTHOR: sp3atlinuxmail.org & 5patlinuxmail.org + + + Mor0ccan Nightmares + + +...

security flaw

HTTP response smuggling vulnerability in Mozilla Firefox and Thunderbird before 1.5.0.4, when used with certain proxy servers, allows remote attackers to cause Firefox to interpret certain responses as if they were responses from two different sites via 1 invalid HTTP response headers with spaces...