5327 matches found
PT-2020-2653 · Jenkins · Jenkins Artifactory Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Artifactory Plugin versions 3.6.0 and earlier Description: The issue is related to the transmission of configured passwords in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. This...
SUSE-SU-2020:0763-1 Security Beta update for Salt
This update fixes the following issues: salt: - Requiring python3-distro only for openSUSE/SLE = 15 - Use full option name instead of undocumented abbreviation for zypper - Python-distro is only needed for Python 3.7. Removing it for Python 2 - Fixed a local privilege escalation to root bsc115746...
Path Traversal
Overview Versions of sapper prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing URL-encoded ../. You may test a sapper application running in prod mode with curl -vvv...
SUSE-SU-2020:0540-1 Security Beta update for Salt
This update fixes the following issues: salt: - Fix 'osfamily' grain for Astra Linux Common Edition - Update to Salt version 2019.2.3 CVE-2019-17361 bsc1163981 See release notes: https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html - Enable passing grains to start event based on...
Storefront install error 0x00000643 when upgrading to 7.15 CU3
Error upgrading Storefront 7.15 CU2 to CU3. Error in log Failed to install component 'StoreFront'. 'CitrixStoreFront-x64.exe' component failed to install with error 0x00000643...
OPENSUSE-SU-2020:0210-1 Security update for chromium
This update for chromium fixes the following issues: Chromium was updated to version 80.0.3987.87 boo1162833. Security issues fixed: - CVE-2020-6381: Integer overflow in JavaScript boo1162833. - CVE-2020-6382: Type Confusion in JavaScript boo1162833. - CVE-2019-18197: Multiple vulnerabilities in...
PT-2020-15329 · Jenkins · Jenkins Brakeman Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Brakeman Plugin versions 0.12 and earlier Description: The issue is related to a stored cross-site scripting vulnerability. It occurs because the plugin does not escape values received from parsed JSON files when rendering them. This...
Command Injection
Overview curling is a node wrapper for curl with a very simple api. Affected versions of this package are vulnerable to Command Injection via the runcommand,cb function. The command argument can be controlled by users without any sanitization. PoC by JHU System Security Lab js var root =...
PYSEC-2020-155
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...
ALPINE-CVE-2020-1931
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration .cf files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian...
GHSA-977J-XJ7Q-2JR9 Segmentation faultin TensorFlow when converting a Python string to `tf.float16`
Impact Converting a string from Python to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which...
PT-2020-20124 · Open Source Matters · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.15 Description: An issue was discovered in Joomla! where missing token checks in the batch actions of various components cause CSRF vulnerabilities. Recommendations: For versions prior to 3.9.15, update to versio...
PT-2020-4061 · Nghttp2 +9 · Nghttp2 +9
Name of the Vulnerable Software and Affected Versions: nghttp2 versions prior to 1.41.0 Description: The issue is related to the handling of HTTP/2 SETTINGS frames in nghttp2, where an overly large frame payload can cause a denial of service. A malicious client can construct a SETTINGS frame with...
PT-2020-19474 · Hashicorp · Hashicorp Vault Enterprise
Name of the Vulnerable Software and Affected Versions: HashiCorp Vault Enterprise versions 0.11.0 through 1.3.1 Description: The issue arises when HashiCorp Vault Enterprise fails to revoke dynamic secrets for a mount in a deleted namespace under certain circumstances. This problem does not speci...
Release notes for Veeam Backup for Microsoft 365 4a
Challenge Release Notes for Veeam Backup for Microsoft 365 4a. Cause Please confirm you are running Veeam Backup for Microsoft 365 version 2.0, 3.0 or 4.0 prior to installing the new version 4a 4.0.0.1553. You can check the product version under Help About in the Veeam Backup for Microsoft 365...
OPENSUSE-SU-2020:0014-1 Security update for php7-imagick
This update for php7-imagick fixes the following issues: Upgrade to version 3.4.4: Added: function Imagick::optimizeImageTransparency METRICSTRUCTURALSIMILARITYERROR METRICSTRUCTURALDISSIMILARITYERROR COMPRESSIONZSTD - https://github.com/facebook/zstd COMPRESSIONWEBP CHANNELCOMPOSITEMASK...
FreeBSD : py-matrix-synapse -- multiple vulnerabilities (ed8cbad5-21a8-11ea-9b6d-901b0e934d69)
Matrix developers report : The synapse 1.7.1 release includes several security fixes as well as a fix to a bug exposed by the security fixes. All previous releases of Synapse are affected. Administrators are encouraged to upgrade as soon as possible. - Fix a bug which could cause room events to b...
MGASA-2019-0384 Updated wireshark packages fix security vulnerability
Version 3.0.7 fixes the following security vulnerability: CMS dissector crash CVE-2019-19553. This update also brings the Mageia package from version 3.0.4 to 3.0.7...
PT-2019-15807 · Hashicorp +1 · Terraform +1
Name of the Vulnerable Software and Affected Versions: Terraform versions prior to 0.12.17 Description: The issue concerns the transmission of sensitive data in cleartext HTTP when using the Azure backend with a shared access signature SAS in Terraform. This affects the...
