CVE-2019-8698

CVE-2019-8698 affects Apple Profiles component entitlement verification. A validation issue could allow a malicious app to restrict access to websites. Apple fixed the issue in iOS 12.4 and tvOS 12.4; remediation is updating to these versions. The surrounding Apple security documentation explicit...

Rack CVE-2019-16782 Information Disclosure Vulnerability

Description Rack is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Rack Project Rack 0.1 Rack Project Rack 0.2 Rack Project Rack 0.3 Rack Project Rack 0.4 Rack Project Rack...

Samsung J7 Pro Access Control Error Vulnerability (CNVD-2020-14676)

The Samsung J7 Pro is a smartphone from the South Korean company Samsung Samsung. The Samsung J7 Pro build fingerprint: samsung/j7y17lteubm/j7y17lte:8.1.0/M1AJQ/J730GMUBS6BSC1:user/release-keys in the com.samsung.android. An access control error vulnerability exists in the themecenter app. The...

PT-2019-15978 · Libspiro · Libspiro

Name of the Vulnerable Software and Affected Versions: Libspiro versions prior to 20190731 Description: The issue is related to a stack-based buffer overflow in the spiro to bpath0 function, located in the spiro.c file. This overflow can potentially lead to an out-of-bounds write. Recommendations...

Atlassian Application Links CVE-2019-15011 Information Disclosure Vulnerability

Description Atlassian Application Links is prone to an information-disclosure vulnerability. An attacker can exploit this issue to obtain sensitive information. That may aid in further attacks. The following versions of Atlassian Application Links are affected: Versions prior to 5.0.12 Versions...

PT-2019-13483 · Unknown · En100 Ethernet Module Iec 61850 Variant +4

Name of the Vulnerable Software and Affected Versions: EN100 Ethernet module DNP3 variant All versions EN100 Ethernet module IEC 61850 variant All versions V4.37 EN100 Ethernet module IEC104 variant All versions EN100 Ethernet module Modbus TCP variant All versions EN100 Ethernet module PROFINET ...

PT-2019-15361 · Unknown · Control Center Server

Name of the Vulnerable Software and Affected Versions: Control Center Server CCS versions prior to V1.5.0 Description: A vulnerability has been identified in the SFTP service of the Control Center Server, which does not properly limit its capabilities. This could allow an unauthenticated remote...

DRUPAL-CONTRIB-2019-095

The Permissions by Term module extends Drupal by functionality for restricting access to single nodes via taxonomy terms. The module doesn't sufficiently restrict access to node previews, when the Search API module is used to display nodes in search result lists...

PT-2019-6142 · Nlnet +8 · Unbound +8

Name of the Vulnerable Software and Affected Versions: Unbound versions prior to 1.9.5 Description: The issue is related to the dname pkt copy function in the Unbound DNS server, which may allow a remote attacker to cause a denial of service due to an assertion failure when handling an invalid...

D-Link DIR-615 CVE-2019-19743 Privilege Escalation Vulnerability

Description D-Link DIR-615 is prone to a privilege-escalation vulnerability. An attacker may exploit this issue to gain elevated privileges. Technologies Affected D-Link DIR-615 Recommendations Block external access at the network boundary, unless external parties require service. If applicable,...

PT-2019-6163 · Netty +2 · Netty +2

Name of the Vulnerable Software and Affected Versions: Netty versions prior to 4.1.44 Description: The issue is related to the HttpObjectDecoder.java component in Netty, which lacks a check for the presence of a colon in HTTP headers. This could lead to incorrect syntax interpretation or be seen ...

SQLite Multiple Security Vulnerabilities

Description SQLite is prone to the following security vulnerabilities. 1. A denial-of-service vulnerability 2. A security vulnerability An attacker can exploit these issues to cause the application to crash, denying service to legitimate users. Technologies Affected SQLite SQLite 1.2.2 SQLite...

PAN-OS: Custom-role users may escalate privileges

An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0.20; 8.1 versions prior to 8.1.11; 9....

Dell Command Update DSA-2019-162 Multiple Arbitrary File Deletion Vulnerabilities

Description Dell Command Update is prone to multiple arbitrary-file-deletion vulnerabilities. Successfully exploiting these issues will allow attackers to delete arbitrary files in the context of the application. Dell Command Update version prior to 3.1 are vulnerable. Technologies Affected Dell...

Redhat KeyCloak CVE-2019-14910 Authentication Bypass Vulnerability

Description Redhat KeyCloak is prone to an authentication-bypass vulnerability. Remote attackers can exploit this issue to bypass the authentication mechanism and gain unauthorized access. Technologies Affected Redhat keycloak 7.0.0 Redhat keycloak 7.0.1.Final Recommendations Block external acces...

GHSA-CMCH-296J-WFVW Arbitrary File Write in iobroker.js-controller

Versions of iobroker.controller prior to 2.0.25 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended /adapter/ folder, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the...

Django CVE-2019-19118 Privilege Escalation Vulnerability

Description Django is prone to a privilege-escalation vulnerability. A remote attacker can exploit this issue to gain elevated privileges and perform unauthorized actions on an affected system. Django versions prior to 2.2.8 and 2.1.15 are vulnerable. Technologies Affected Djangoproject Django 2....

Ansible CVE-2019-14905 OS Command Injection Vulnerability

Description Ansible is prone to an OS command-injection vulnerability. An attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. Versions prior to Ansible 2.9.2, 2.8.8 and 2.7.16 are vulnerable...

Apache cordova-plugin-inappbrowser CVE-2019-0219 Privilege Escalation Vulnerability

Description Apache cordova-plugin-inappbrowser is prone to a privilege-escalation vulnerability. Remote attackers can exploit this issue to gain elevated privileges or execute arbitrary code in the context of the affected application. Versions prior to Apache cordova-plugin-inappbrowser 3.1.0 are...

Multiple Pivotal RabbitMQ Products CVE-2019-11291 Cross Site Scripting Vulnerability

Description Multiple Pivotal RabbitMQ products are prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected...