PT-2019-4754

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.0 and 5.3 Description The issue is related to a non-upstream patch in the Linux kernel, specifically in the shiftfs component. It involves a type conversion error, where the shiftfs btrfs ioctl fd replace function calls...

PT-2019-4753

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.0 and 5.3 Description The issue is related to an uncontrolled resource consumption in the shiftfs component of the Linux kernel. Exploitation of this issue may allow an attacker to cause a denial of service. The problem...

Design/Logic Flaw

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...

CVE-2019-15053

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...

CVE-2019-15053

The CVE-2019-15053 issue affects the HTML Include and replace macro plugin for Confluence Server (pre-1.5.0). A bypass of the includeScripts=false XSS protection via an IFRAME vector is documented, enabling cross-site scripting. Connected sources show a public exploit draft and vendor advisories ...

CVE-2019-15053: Improper Neutralization of Input During Web Page Generation

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element...

The vulnerability of the node-tar module in the Node.js library allows a hacker to replace the existing content of a file.

The vulnerability of the node-tar module in the Node.js library is related to an incorrect definition of the reference before accessing the file. Exploiting this vulnerability could allow a remote attacker to replace the existing content of the file...

avatar allows changing other users' avatars

avatar does not implement a permission check for the HTTP URL used to replace user avatars. This allows any user with Overall/Read permission to change any other user's avatar, in addition to their own. As of publication of this advisory, there is no fix...

CVE-2019-14362

Openbravo ERP before 3.0PR19Q1.3 is affected by Directory Traversal. This vulnerability could allow remote authenticated attackers to replace a file on the server via the getAttachmentDirectoryForNewAttachment inpKey value...

PT-2019-13641

Name of the Vulnerable Software and Affected Versions Openbravo ERP versions prior to 3.0PR19Q1.3 Description The issue allows remote authenticated attackers to replace a file on the server. This is achieved via the getAttachmentDirectoryForNewAttachment inpKey value. Recommendations For versions...

The vulnerability of the PrintControl information protection software “Blockhost – Network K” lies in the lack of checks for the integrity of uploaded libraries, allowing a perpetrator to execute arbitrary code.

The vulnerability of the PrintControl information protection software “Blockhost – Network K” lies in the lack of checks for the integrity of the libraries being loaded. Exploiting this vulnerability allows a malicious actor, operating locally, to execute arbitrary code with privileges of...

PT-2019-16921 · Ibm · Ibm Spectrum Protect +1

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Storage Manager Server IBM Spectrum Protect versions 7.1 through 8.1 Description: The issue allows a local user to replace existing databases by restoring old data. Recommendations: For versions 7.1 through 8.1, update to a version...

libvirt security update

0.10.2-64.0.1 - Replace docs/et.png in tarball with blank image 0.10.2-64.el610.2 - api: disallow virDomainSaveImageGetXMLDesc on read-only connections CVE-2019-10161...

Buffer overflow

radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact, as demonstrated by newstr buffer overflows during replace operations. This affects libr/asm/asm.c and libr/parse/parse.c...

Information Disclosure

ansible is vulnerable to Information Disclosure. An unsafe template evaluation of returned module data exists, allowing an attacker to read and replace files...

Three Common Questions (and Answers) About Next-Gen AV

Most organizations with traditional, or legacy, antivirus AV solutions are well aware that they are no longer protected from the more advanced tactics and threats of attackers today. Signatures just can’t keep up with emerging threats. But that doesn’t mean that everyone is ready to dive head fir...

CVE-2019-6566: Improper Access Control

GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller with a malicious version, which could allow an attacker to gain administrator privileges to the system...

NREL BEopt <= 2.8.0.0 RCE Vulnerability

NREL BEopt is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nrel:beopt"; if...

GHSA-VVWP-3F54-XC39 Downloads Resources over HTTP in broccoli-closure

Affected versions of broccoli-closure insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on t...

GHSA-G785-775G-F2G8 Downloads Resources over HTTP in haxe

Affected versions of haxe insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system...