π¨ CVE-2019-17559
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
π@cveNotify
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
π@cveNotify
π¨ CVE-2019-17565
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
π@cveNotify
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
π@cveNotify
π¨ CVE-2020-10875
Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such as /include/viewtagdb.psp.
π@cveNotify
Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such as /include/viewtagdb.psp.
π@cveNotify
π¨ CVE-2020-10879
rConfig before 3.9.5 allows injection because lib/crud/search.crud.php does not properly construct a find command.
π@cveNotify
rConfig before 3.9.5 allows injection because lib/crud/search.crud.php does not properly construct a find command.
π@cveNotify
π¨ CVE-2020-1944
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
π@cveNotify
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
π@cveNotify
π¨ CVE-2020-5252
The command-line "safety" package for Python has a potential security issue.
There are two Python characteristics that allow malicious code to Γ’β¬Εpoison-pillΓ’β¬? command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages.
This vulnerability is considered to be of low severity because the attack makes use of an existing Python condition, not the Safety tool itself.
This can happen if:
You are running Safety in a Python environment that you donΓ’β¬β’t trust.
You are running Safety from the same Python environment where you have your dependencies installed.
Dependency packages are being installed arbitrarily or without proper verification.
Users can mitigate this issue by doing any of the following:
Perform a static analysis by installing Docker and running the Safety Docker image: $ docker run --rm -it pyupio/safety check -r requirements.txt
Run Safety against a static dependencies list, such as the requirements.txt file, in a separate, clean Python environment.
Run Safety from a Continuous Integration pipeline.
Use PyUp.io, which runs Safety in a controlled environment and checks Python for dependencies without any need to install them.
Use PyUp's Online Requirements Checker.
π@cveNotify
The command-line "safety" package for Python has a potential security issue.
There are two Python characteristics that allow malicious code to Γ’β¬Εpoison-pillΓ’β¬? command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages.
This vulnerability is considered to be of low severity because the attack makes use of an existing Python condition, not the Safety tool itself.
This can happen if:
You are running Safety in a Python environment that you donΓ’β¬β’t trust.
You are running Safety from the same Python environment where you have your dependencies installed.
Dependency packages are being installed arbitrarily or without proper verification.
Users can mitigate this issue by doing any of the following:
Perform a static analysis by installing Docker and running the Safety Docker image: $ docker run --rm -it pyupio/safety check -r requirements.txt
Run Safety against a static dependencies list, such as the requirements.txt file, in a separate, clean Python environment.
Run Safety from a Continuous Integration pipeline.
Use PyUp.io, which runs Safety in a controlled environment and checks Python for dependencies without any need to install them.
Use PyUp's Online Requirements Checker.
π@cveNotify
GitHub
GitHub - akoumjian/python-safety-vuln: Circumvent any python package scanner installed to the same python environment.
Circumvent any python package scanner installed to the same python environment. - akoumjian/python-safety-vuln
π¨ CVE-2020-10570
The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature.
π@cveNotify
The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature.
π@cveNotify
GitHub
0ffsecninja.github.io/Telegram:CVE-2020-10570 at master Β· 0ffsecninja/0ffsecninja.github.io
Contribute to 0ffsecninja/0ffsecninja.github.io development by creating an account on GitHub.
π¨ CVE-2020-10684
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
π@cveNotify
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
π@cveNotify
π¨ CVE-2020-1744
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
π@cveNotify
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
π@cveNotify
π¨ CVE-2020-9359
KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.
π@cveNotify
KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.
π@cveNotify
GitLab
Document::processAction: If the url points to a binary, don't run it (6a93a033) Β· Commits Β· Graphics / Okular Β· GitLab
KDE document viewer
π¨ CVE-2020-10931
Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c.
π@cveNotify
Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c.
π@cveNotify
GitHub
Fix security issue reported by someone. Β· memcached/memcached@02c6a2b
someone will get their name attributed for future issues if they bother
following procedure.
following procedure.
π¨ CVE-2020-1747
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
π@cveNotify
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
π@cveNotify
π¨ CVE-2020-10385
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
π@cveNotify
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
π@cveNotify
packetstorm.news
Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories, and Whitepapers
π¨ CVE-2020-4253
IBM Content Navigator 3.0CD does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 175559.
π@cveNotify
IBM Content Navigator 3.0CD does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 175559.
π@cveNotify
Ibmcloud
IBM X-Force Exchange
IBM X-Force Exchange is a threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers
π¨ CVE-2020-4309
IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user which could be used to aid in further attacks against the system. IBM X-Force ID: 177080.
π@cveNotify
IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user which could be used to aid in further attacks against the system. IBM X-Force ID: 177080.
π@cveNotify
Ibmcloud
IBM X-Force Exchange
IBM X-Force Exchange is a threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers
π¨ CVE-2020-10938
GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c.
π@cveNotify
GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c.
π@cveNotify
π¨ CVE-2019-4553
IBM API Connect V5.0.0.0 through 5.0.8.7iFix3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 165958.
π@cveNotify
IBM API Connect V5.0.0.0 through 5.0.8.7iFix3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 165958.
π@cveNotify
Ibmcloud
IBM X-Force Exchange
IBM X-Force Exchange is a threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers
π¨ CVE-2019-4681
IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171734.
π@cveNotify
IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171734.
π@cveNotify
Ibmcloud
IBM X-Force Exchange
IBM X-Force Exchange is a threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers
π¨ CVE-2019-18242
In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, frequent and multiple requests for short-term use may cause the web server to fail.
π@cveNotify
In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, frequent and multiple requests for short-term use may cause the web server to fail.
π@cveNotify
π¨ CVE-2020-6972
In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Serverβs authentication may be bypassed by a capture-replay attack from a web browser.
π@cveNotify
In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Serverβs authentication may be bypassed by a capture-replay attack from a web browser.
π@cveNotify