Security Bulletin: IBM Security Guardium is aware of a GnuTLS vulnerability

Summary IBM Security Guardium is aware of the following vulnerabilities Vulnerability Details CVE-2018-10846, CVE-2018-10845, CVE-2018-10844 Affected Products and Versions Affected IBM Security Guardium | Affected Versions ---|--- IBM Security Guardium | 9 - 9.5 IBM Security Guardium | 10 - 10.5...

CVE-2018-7603 Search Autocomplete

In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website nodes, comments, etc.. The module doesn't sufficiently filter user-entered...

CVE-2017-18320

QSEE unload attempt on a 3rd party TEE without previously loading results in a data abort in snapdragon automobile and snapdragon mobile in versions MSM8996AU, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 ...

Code injection

QSEE unload attempt on a 3rd party TEE without previously loading results in a data abort in snapdragon automobile and snapdragon mobile in versions MSM8996AU, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 ...

CVE-2017-18141

When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will give it access to privileged functions meant to only be accessible from the TEE in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions IPQ8074, MDM9206,...

CVE-2017-18320

CVE-2017-18320 describes a data abort in QSEE when unloading on a third-party TEE without prior loading, affecting Qualcomm Snapdragon automotive/mobile platforms across numerous SoCs (e.g., MSM8996AU, SD 410/12, 820, 835, 650/52, 710/670, 810, 820A, 835, 660, several SDM/SXR variants). The linke...

SUSE SLED15 / SLES15 Security Update : containerd, docker / go (SUSE-SU-2018:4297-1)

This update for containerd, docker and go fixes the following issues : containerd and docker : Add backport for building containerd bsc1102522, bsc1113313 Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce. bsc1102522 Enable seccomp support on SLE12 fate325877 Update to...

openSUSE Security Update : containerd / docker and go (openSUSE-2018-1626)

This update for containerd, docker and go fixes the following issues : containerd and docker : - Add backport for building containerd bsc1102522, bsc1113313 - Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce. bsc1102522 - Enable seccomp support fate325877 - Update to...

Security update for containerd, docker and go (important)

This update for containerd, docker and go fixes the following issues: containerd and docker: - Add backport for building containerd bsc1102522, bsc1113313 - Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce. bsc1102522 - Enable seccomp support fate325877 - Update to container...

Mail.ru: benchmark metrics available at 5.61.239.154

Benchmark data for 3rd party product was available from outside. Benchmarking was performed using generated data in isolated testing evironment, so no actual data or production information was leaked...

ReFS Known Issues, Considerations, and Limitations

Known Issues Memory Management Issues Server 2016 and older Windows repositories using ReFS on Server 2016 without the September 2018 updates or older OS versions are known to have issues during backup job retention enforcement, which manifests as: The repository server becomes unresponsive or...

Microsoft Data Sharing - Local Privilege Escalation Exploit

Exploit for windows platform in category local exploits Microsoft Data Sharing - Local Privilege Escalation Exploit Bug description: RpcDSSMoveFromSharedFilehandle,L"token",L"c:\blah1\pci.sys"; This function exposed over alpc, has a arbitrary delete vuln. Hitting the timing was pretty annoying...

GHSA-CHP4-RV79-68J3 Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one...

Denial of Service in PAN-OS Management Web Interface

Palo Alto Networks makes use of a 3rd-party component impacted by CVE-2018-8715. This issue has been confirmed to present a risk for denial of service to the PAN-OS Management Web Interface. Ref PAN-93089, CVE-2018-8715 A specially crafted HTTP POST request with an invalid “If-modified" header...

Scan QR Codes Safely with the Trend Micro QR Scanner

Using your camera and a QR code scanner on your mobile device, it’s easy to scan a code to download an app or go to a website—a bit too easy, some might say. What if the QR code is for a malicious app, or takes you to a dangerous website? How would you know before it’s too late? Trend Micro’s fre...

Google Blocks Chrome Extension Installations From 3rd-Party Sites

You probably have come across many websites that let you install browser extensions without ever going to the official Chrome web store. It's a great way for users to install an extension, but now Google has decided to remove the ability for websites to offer "inline installation" of Chrome...

CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

Upserve : Blind stored xss in demo form

Through Upserve's demo request form, @pareshparmar found a blind XSS in a 3rd party package for Upserve's CRM system. While the CRM system and 3rd party package are out of scope for our program, we decided to reward @pareshparmar for his work in bringing this issue to our attention. - Endpoint...

Doorkeeper gem has stored XSS on authorization consent view

Stored XSS on the OAuth Client's name will cause users being prompted for consent via the "implicit" grant type to execute the XSS payload. The XSS attack could gain access to the user's active session, resulting in account compromise. Any user is susceptible if they click the authorization link...

ansible-vault Yaml Load Code Execution Vulnerability

Summary An exploitable vulnerability exists in the yaml loading functionality of ansible-vault. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability. Tested Versions ansible-vault...