CVE-2019-2133

In MfcTransceive of phNxpExtnsMifareStd.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0...

CVE-2019-2132

It is possible to overlay the VPN dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0...

CVE-2019-2129

In extract3GPPGlobalDescriptions of TextDescriptions.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions:...

CVE-2019-2126

In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0...

Oracle Linux 8 : mysql:8.0 (ELSA-2019-2511)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2511 advisory. mecab 0.996-1.9 - Release bump for rebuilding on new arches Related: 1518842 0.996-1.8 - skip %verify of /etc/opt/rh/rh-mysql57/mecabrc Resolves: 13823...

RHEL 8 : mysql:8.0 (RHSA-2019:2511)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2511 advisory. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld, and many client programs. The...

mysql: Server: Parser unspecified vulnerability (CPU Jan 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Parser. Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

ALSA-2019:2511 Important: mysql:8.0 security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld, and many client programs. The following packages have been upgraded to a later upstream version: mysql 8.0.17. Security Fixes: mysql: Server: Replication multiple unspecified vulnerabilities...

Security Bulletin: IBM MQ Appliance is affected by a command injection vulnerability (CVE-2019-4294)

Summary IBM MQ Appliance has addressed the following command injection vulnerability. Vulnerability Details CVEID: CVE-2019-4294 DESCRIPTION: IBM DataPower and IBM MQ Appliance could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability...

Security Bulletin: IBM MQ Appliance is affected by a GNU C library (glibc) vulnerability (CVE-2017-8804)

Summary IBM MQ Appliance has addressed a vulnerability in GNU C library glibc. Vulnerability Details CVEID: CVE-2017-8804 DESCRIPTION: glibc is vulnerable to a denial of service, caused by improper handling of buffer deserialization in the xdrbytes and xdrstring functions. By sending a...

Cross site request forgery (csrf)

6kbbs 7.1 and 8.0 allows CSRF via portalchannelajax.php id or code parameter or admin.php fileids parameter...

CVE-2015-9292

CVE-2015-9292 affects 6kbbs versions 7.1 and 8.0, where a CSRF vulnerability exists in the web interfaces. The flaw allows cross-site requests to be forged via portalchannel_ajax.php (parameters id or code) or admin.php (parameter fileids). The description does not specify affected platforms beyo...

Security Bulletin: IBM MQ clients are vulnerable to a denial of service attack caused by consuming specifically crafted messages (CVE-2019-4261)

Summary An error was found with the IBM MQ client message handling logic that causes a denial of service attack when specifically crafted messages are consumed. Vulnerability Details CVEID: CVE-2019-4261 DESCRIPTION: IBM MQ Clients are vulnerable to a denial of service attack caused by specially...

CVE-2019-7000 Avaya Aura Conferencing XSS

A Cross-Site Scripting XSS vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 8.0.14. Prior versions not listed were not evaluated...

PT-2019-18407 · Avaya · Avaya Aura Conferencing

Name of the Vulnerable Software and Affected Versions: Avaya Aura Conferencing versions prior to 8.0 SP14 8.0.14 Description: A Cross-Site Scripting XSS issue in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Recommendations: For Ava...

Oracle MySQL Server 8.0 <= 8.0.16 Security Update (cpujul2019) - Windows

Oracle MySQL Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql"; if...

Oracle MySQL Server 5.7 <= 5.7.26 / 8.0 <= 8.0.16 Security Update (cpujul2019) - Windows

Oracle MySQL Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql"; if...

MySQL 8.0.x < 8.0.17 Multiple Vulnerabilities (July 2019 CPU)

The version of MySQL running on the remote host is 8.0.x prior to 8.0.17. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the July 2019 and October 2022 Critical Patch Update advisories: - An unspecified vulnerability in the...

Privilege Escalation in PAN-OS

Palo Alto Networks is aware of a use-after-free UAF vulnerability in the Linux kernel's sockfssetattr. Ref: PAN-113631/ CVE-2019-8912 Successful exploitation of this issue may allow an unprivileged local user to escalate their privileges on the system. This issue affects PAN-OS 7.1.23 and earlier...

Sql injection

A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions...