Debian DLA-1980-1 : wordpress security update

Several vulnerabilities in wordpress, a web blogging tool, have been fixed. CVE-2019-17669 Server Side Request Forgery SSRF vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters. CVE-2019-17670 Server Side Request Forgery SSRF...

[SECURITY] [DLA 1980-1] wordpress security update

Package : wordpress Version : 4.1.28+dfsg-0+deb8u1 CVE ID : CVE-2019-17669 CVE-2019-17670 CVE-2019-17671 CVE-2019-17675 Debian Bug : 942459 Several vulnerabilities in wordpress, a web blogging tool, have been fixed. CVE-2019-17669 Server Side Request Forgery SSRF vulnerability because URL...

CVE-2019-18661

Fastweb FASTGate 1.0.1b devices allow partial authentication bypass by changing a certain checkpwd return value from 0 to 1. An attack does not achieve administrative control of a device; however, the attacker can view all of the web pages of the administration console...

CVE-2019-17671

In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled...

CVE-2019-17671

In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled...

UBUNTU-CVE-2019-17671

In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled...

CVE-2019-17671

In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled...

CVE-2019-17671

In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled...

CVE-2019-17671

WordPress up to version 5.2.4 contains an information disclosure vulnerability caused by mishandling the static query property, allowing unauthenticated users to view certain private/draft content. The issue is triggered without authentication and affects WordPress prior to 5.2.4. A remediation i...

CVE-2019-17671

In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, and Adobe Acrobat 2017/Adobe Acrobat Reader 2017 involve an exploit where operations are performed outside the buffer in memory, allowing attackers to execute arbitrary code.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, and Adobe Acrobat Reader 2017 are related to the execution of operations beyond the buffer in memory. Exploiting these vulnerabilities can allow a...

WordPress Core < 5.2.3 - Viewing Unauthenticated/Password/Private Posts

So far we know that adding ?static=1 to a wordpress URL should leak its secret content Here are a few ways to manipulate the returned entries: - order with asc or desc - orderby - m with m=YYYY, m=YYYYMM or m=YYYYMMDD date format In this case, simply reversing the order of the returned elements...

Memory Corruption Vulnerability in Good123 Viewer

Good123 Viewer is an image viewing software. A memory corruption vulnerability exists in Good123 Photo Viewer, which can be exploited by an attacker to cause the program to crash by constructing a malformed BMP image...

aqua-microscanner showed plain text credential in configuration form

aqua-microscanner stores a token credential in its global Jenkins configuration. While the token is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the token through browser extensions, cross-site scripting...

UBUNTU-CVE-2019-16723

In Cacti through 1.2.6, authenticated users may bypass authorization checks for viewing a graph via a direct graphjson.php request with a modified localgraphid parameter...

CVE-2019-16723

In Cacti through 1.2.6, authenticated users may bypass authorization checks for viewing a graph via a direct graphjson.php request with a modified localgraphid parameter...

cacti -- Authenticated users may bypass authorization checks

The cacti developers reports: In Cacti through 1.2.6, authenticated users may bypass authorization checks for viewing a graph via a direct graphjson.php request with a modified localgraphid parameter...

WordPress cysteme-finder plugin code issue vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A code issue vulnerability exists in the WordPress cysteme-finder plugin prior to version 1.4, which stems fro...

CVE-2019-15753

In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instance...

Image gallery suffers from denial of service vulnerability (CNVD-2019-30308)

Photo Gallery is an image viewing and management software that supports all formats. A denial of service vulnerability exists in Picture Gallery, which can be exploited by attackers to cause a denial of service...