CVE-2017-18422

In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions SEC-272...

Code injection

In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions SEC-272...

CVE-2017-18422

In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions SEC-272...

CVE-2019-10168

The virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's...

CVE-2019-10166

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local...

Security Bulletin: NVIDIA GPU Display Driver - August 2019

NVIDIA has released a software security update for the NVIDIA GPU Display Driver. This update addresses issues that may lead to local code execution, denial of service, or escalation of privileges. To protect your system, download and install this software update through NVIDIA Driver Downloads G...

SEW 1006-403-4-00 Phase Inverter

Binary data 764792.prm...

Null pointer dereference

A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to...

AZL-44634 CVE-2019-10744 affecting package js-jquery 3.5.0-4

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

FreeBSD-SA-19:13.pts

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:13.pts Security Advisory The FreeBSD Project Topic: pts4 write-after-free Category: core Module: kernel Announced: 2019-07-24 Credits: syzkaller Affects: All...

FreeBSD -- pts(4) write-after-free

Problem Description: The code which handles a close2 of a descriptor created by posixopenpt2 fails to undo the configuration which causes SIGIO to be raised. This bug can lead to a write-after-free of kernel memory. Impact: The bug permits malicious code to trigger a write-after-free, which may b...

Squid Security Update Advisory (SQUID-2018:4)

Squid is prone to a cross-site scripting vulnerability to incorrect input handling when generating HTTPS response messages about TLS errors. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Squid Security Update Advisory SQUID-2019:1

Squid is prone to a denial of service vulnerability due to incorrect string termination the cachemgr.cgi which may access unallocated memory. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

CVE-2019-3570

Call to the scryptenc function in HHVM can lead to heap corruption by using specifically crafted parameters N, r and p. This happens if the parameters are configurable by an attacker for instance by providing the output of scryptenc in a context where Hack/PHP code would attempt to verify it by...

Information disclosure

Call to the scryptenc function in HHVM can lead to heap corruption by using specifically crafted parameters N, r and p. This happens if the parameters are configurable by an attacker for instance by providing the output of scryptenc in a context where Hack/PHP code would attempt to verify it by...

CVE-2019-1010283

Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function dataonconnection in src/callback.c. The attack vector is: network connectivity. The fixed...

Design/Logic Flaw

Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function dataonconnection in src/callback.c. The attack vector is: network connectivity. The fixed...

Redis Unauthenticated Code Execution

This module can be used to leverage the extension functionality added by Redis 4.x and 5.x to execute arbitrary code. To transmit the given extension it makes use of the feature of Redis which called replication between master and slave...

PT-2019-11541 · Univention · Univention Corporate Server

Name of the Vulnerable Software and Affected Versions: Univention Corporate Server univention-directory-notifier versions 12.0.1-3 and earlier Description: The issue affects the function data on connection in src/callback.c, allowing intentional information exposure through network connectivity,...

jsonnet/convert_jsonnet_fuzzer: Heap-use-after-free in Interpreter::evaluate

Detailed report: https://oss-fuzz.com/testcase?key=5651117746159616 Project: jsonnet Fuzzer: libFuzzerjsonnetconvertjsonnetfuzzer Fuzz target binary: convertjsonnetfuzzer Job Type: libfuzzerasanjsonnet Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x6210000128d0 Crash...