CVE-2019-11512

Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...

Sql injection

Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...

CVE-2019-11512

CVE-2019-11512 describes an SQL injection in Contao 4.x, exploitable via the file manager. Affected versions span Contao 4.1 through 4.7.4, with exposure up to 4.4.38. The issue is fixed in Contao 4.4.39 and 4.7.5 (as confirmed by multiple sources). Red Hat notes the same fixed versions; other ad...

Linux kernel information disclosure vulnerability (CNVD-2019-23988)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. An information disclosure vulnerability exists in Linux kernel versions 4.1 through 4.x and 5.x prior to 5.0.8. The vulnerability arises from errors such as...

[SECURITY] [DLA 1845-1] dosbox security update

Package : dosbox Version : 0.74-4+deb8u1 CVE ID : CVE-2019-7165 CVE-2019-12594 Debian Bug : 931222 Several security vulnerabilities were discovered in DOSBox, an emulator for running old DOS programs. CVE-2019-7165 A very long line inside a bat file would overflow the parsing buffer which could b...

CVE-2019-10639: Inadequate Encryption Strength

The Linux kernel 4.x starting from 4.1 and 5.x before 5.0.8 allows Information Exposure partial kernel address disclosure, leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols e.g....

Siemens SIMATIC SCALANCE M876-4 LTE (4G) NAM

Binary data 764595.prm...

openSUSE Security Update : phpMyAdmin (openSUSE-2019-1689)

This update for phpMyAdmin fixes the following issues : phpMyAdmin was updated to 4.9.0.1 : - Several issues with SYSTEM VERSIONING tables - Fixed json encode error in export - Fixed JavaScript events not activating on input sql bookmark issue - Show Designer combo boxes when adding a constraint ...

FreeBSD -- Privilege escalation in cd(4) driver

Problem Description: To implement one particular ioctl, the Linux emulation code used a special interface present in the cd4 driver which allows it to copy subchannel information directly to a kernel address. This interface was erroneously made accessible to userland, allowing users with read...

Security Bulletin: Speculative Store Bypass (SSB) vulnerability also known as SpectreNG or Variant 4 affects IBM Spectrum Protect Plus (CVE-2018-3639)

Summary IBM Spectrum Protect Plus may be affected by the Speculative Storage Bypass SSB vulnerability which is also known as SpetreNG or Variant 4. Vulnerability Details CVEID: CVE-2018-3639 DESCRIPTION: Multiple Intel CPU''s could allow a local attacker to obtain sensitive information, caused by...

Qualys Cloud Platform (VM, PC) 8.20 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.20, includes several new features in Qualys Cloud Platform and additional support for multiple technologies in Qualys Policy Compliance. Feature Highlights Qualys Cloud Platform Configure Password Expiration Notification – Now users...

BlueStacks App Player Input Validation Error Vulnerability

BlueStacks App Player is a suite of software from the Chinese company BlueStacks that supports making Android applications run on Windows systems. An input validation error vulnerability exists in BlueStacks App Player version 2, version 3, and version 4 before 4.90. An attacker can exploit this...

Out-of-bounds Read in stringstream

All versions of stringstream are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module i...

CVE-2019-10168

The virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's...

promoneuve.fr Cross Site Scripting vulnerability

Security Researcher SkyEmie Helped patch 53 vulnerabilities Received 2 Coordinated Disclosure badges Received 4 recommendations , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting promoneuve.fr website and its users. Following coordinated an...

Out-of-bounds Read in npmconf

Versions of npmconf before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x. Recommendation Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used...

PT-2019-20005

Name of the Vulnerable Software and Affected Versions npmconf versions prior to 2.1.3 Description The issue arises when a typed number is passed as input on Node.js 4.x, causing npmconf to allocate and write to disk uninitialized memory contents. Recommendations Update to version 2.1.3 or later...

phpMyAdmin < 4.9.0 CSRF Vulnerability (PMASA-2019-4) - Windows

phpMyAdmin is prone to a CSRF vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyadmin:phpmyadmin"; if descripti...

A week in security (June 3 – 9)

Last week on Malwarebytes Labs, we rounded up some leaks and breaches, reported about Magecart skimmers found on Amazon CloudFront CDN, proudly announced we were awarded as Best Cybersecurity Vendor Blog at the annual EU Security Blogger Awards, discussed how Maine inches closer to shutting down...

MetaTrader 4 vs MetaTrader 5 iPhone app

By Owais Sultan If you are an online trading enthusiast, you can use MetaTrader 5 and MetaTrader 4 iPhone apps to trade forex. Though the prime objective of MetaTrader 4 iPhone app and MetaTrader 5 iPhone app is to enable users to have great trading experience, these forex trading apps vary in...