CVE-2019-4454

CVE-2019-4454 affects IBM QRadar SIEM versions 7.3.0–7.3.2 Patch 4. The vulnerability is a cross-site scripting (XSS) issue in the Web UI that can allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected product/component: I...

CVE-2019-4470

IBM QRadar SIEM (7.3.0–7.3.2 Patch 4) is vulnerable to cross‑site scripting that can inject arbitrary JavaScript into the Web UI and may lead to credentials disclosure within a trusted session. The primary affected component is the Web UI of QRadar; root cause is XSS in the UI rendering path. CVS...

CVE-2019-18678

An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between a client and Squid with attacker-controlle...

Siemens Siprotec Unspecified Vulnerability

A vulnerability has been identified in Siemens DIGSI 4 All versions V4.92, EN100 Ethernet module IEC 61850 variant All versions V4.30, EN100 Ethernet module PROFINET IO variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module DNP3 variant All versions,...

Apple Security Update: iOS 13.2.2 and iPadOS 13.2.2

Apple recommends to install security update iOS 13.2.2 and iPadOS 13.2.2 on devices iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation...

RHEL 8 : squid:4 (RHSA-2019:3476)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3476 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: XSS via...

CVE-2005-4890

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process...

CVE-2005-4890

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process...

Google Pixel CVE-2019-2210 Privilege Escalation Vulnerability

Description Google Pixel is prone to a privilege-escalation vulnerability. An attackers may exploit this issue to gain elevated privileges. This issue are being tracked by Android Bug ID A-139148442. Technologies Affected Google Android 10.0 Google Android 9.0 Google Pixel 2 Google Pixel 2 XL...

rotbehonline.com Cross Site Scripting vulnerability

Security Researcher MrRain1996 Helped patch 907 vulnerabilities Received 4 Coordinated Disclosure badges Received 9 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting rotbehonline.com website and its users. Following...

sqlite3:ossfuzz: Heap-use-after-free in sqlite3VdbeAddFunctionCall

Detailed Report: https://oss-fuzz.com/testcase?key=5707309678592000 Project: sqlite3 Fuzzing Engine: libFuzzer Fuzz Target: ossfuzz Job Type: libfuzzerasani386sqlite3 Platform Id: linux Crash Type: Heap-use-after-free WRITE 4 Crash Address: 0xf4d37e80 Crash State: sqlite3VdbeAddFunctionCall...

AZL-41158 CVE-2019-0205 affecting package influxdb for versions less than 2.7.3-4

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings...

abilityvanrentals.com Cross Site Scripting vulnerability

Security Researcher g0bl1nsec Helped patch 3637 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting abilityvanrentals.com website and its users. Following...

skia:skdescriptor_deserialize: Heap-buffer-overflow in SkDescriptor::isValid

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5724700437381120 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: skdescriptordeserialize Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

CVE-2019-18348

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...

A week in security (October 14 – 20)

Last week on Malwarebytes Labs, we tried to unlock the future of the password its vulnerabilities, current alternatives, and possible future disappearance, analyzed the lagging response by many businesses in adopting a patch for Pulse VPN vulnerability, looked at Instagram’s bulked-up security...

CVE-2019-18218

cdfreadpropertyinfo in cdf.c in file through 5.37 does not restrict the number of CDFVECTOR elements, which allows a heap-based buffer overflow 4-byte out-of-bounds write...

Security Bulletin: IBM Netezza Host Management is affected by the vulnerability known as Variant 4 or SpectreNG.

Summary Open Source Kernel is used by IBM Netezza Host Management. IBM Netezza Host Management has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-3639 DESCRIPTION: Multiple Intel CPUs could allow a local attacker to obtain sensitive information, caused by utilizing sequences ...

binutils:fuzz_disassemble: Global-buffer-overflow in exg_sex_discrim

Detailed Report: https://oss-fuzz.com/testcase?key=5752218594050048 Project: binutils Fuzzing Engine: afl Fuzz Target: fuzzdisassemble Job Type: aflasanbinutils Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x000001977e78 Crash State: exgsexdiscrim decodeoperation...

Apple Security Update: iOS 13.1.3 and iPadOS 13.1.3

Apple recommends to install security update iOS 13.1.3 and iPadOS 13.1.3 on devices iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation...