PT-2019-11599 · Red Hat +1 · Podman +1

Name of the Vulnerable Software and Affected Versions: podman versions prior to 1.4.0 Description: A path traversal issue has been found in the way podman handles symlinks inside containers. This could allow an attacker who has already compromised a container to read or write arbitrary files on t...

PT-2019-13607

Name of the Vulnerable Software and Affected Versions Pallets Werkzeug versions prior to 0.15.5 Description The issue is related to how SharedDataMiddleware handles drive names, such as C:, in Windows pathnames. This mishandling can lead to potential security issues. Recommendations For versions...

Paragon Initiative Enterprises: Github wikis are editable by anyone https://github.com/paragonie/password_lock/wiki

submitted a misconfiguration in some of our GitHub repositories to us. Wikis are inherently editable for all users, but for some repositories an organization may want to restrict this access. In some cases it was possible for GitHub users . Github wikis on the following project...

[ASA-201907-4] firefox: multiple issues

Arch Linux Security Advisory ASA-201907-4 ========================================= Severity: Critical Date : 2019-07-17 CVE-ID : CVE-2019-9811 CVE-2019-11709 CVE-2019-11710 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11714 CVE-2019-11715 CVE-2019-11716 CVE-2019-11717 CVE-2019-11718...

Red Hat JBoss Application Server (AS) Console and Web Management Misconfiguration Vulnerability - Active Check

The default configuration of Red Hat JBoss Application Server AS does not restrict access to the console and web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests. SPDX-FileCopyrightText: 2019 Greenbone AG Some text...

PT-2019-6001 · Proclima · Proclima

Name of the Vulnerable Software and Affected Versions: ProClima versions prior to 8.0.0 Description: A vulnerability exists in the software that could allow a malicious DLL file, with the same name as any resident DLLs inside the software installation, to execute arbitrary code. This issue is...

PT-2019-11741 · Jenkins · Jenkins Docker Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Docker Plugin versions 1.1.6 and earlier Description: A missing permission check in the Jenkins Docker Plugin allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This issue is related t...

PT-2021-7981 · Apache · Apache Kafka

Name of the Vulnerable Software and Affected Versions: Apache Kafka versions 2.0.0 through 2.8.0 Description: The issue in Apache Kafka is related to the disclosure of information through inconsistency, allowing a remote attacker to perform a brute force attack. Some components in Apache Kafka us...

ICSA-19-190-04 Siemens Spectrum Power (Update A)

1. EXECUTIVE SUMMARY CVSS v3 4.7 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: Spectrum Power Vulnerability: Cross-site Scripting 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-19-190-04 Siemens Spectrum...

PT-2019-18690 · Prima Systems · Flexair

Name of the Vulnerable Software and Affected Versions: Prima Systems FlexAir versions 2.3.38 and prior Description: The application generates database backup files with a predictable name, allowing an attacker to use brute force to identify the database backup file name. This can be exploited to...

PT-2019-3565 · Advantech · Advantech Webaccess

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess versions 8.3.5 and prior Description: The issue is related to multiple stack-based buffer overflow vulnerabilities in the webvrpcs process of Advantech WebAccess software. These vulnerabilities are caused by a lack of prop...

PT-2019-2961 · Xstream · Xstream

Name of the Vulnerable Software and Affected Versions: XStream versions 1.4.10 through 1.4.10 Description: The issue is related to a regression of a previous deserialization flaw in the XStream API. If the security framework has not been initialized, it may allow a remote attacker to run arbitrar...

Authentication flaw

A vulnerability in Cisco Digital Network Architecture DNA Center could allow an unauthenticated, adjacent attacker to bypass authentication and access critical internal services. The vulnerability is due to insufficient access restriction to ports necessary for system operation. An attacker could...

CVE-2019-1848 Cisco DNA Center Authentication Bypass Vulnerability

A vulnerability in Cisco Digital Network Architecture DNA Center could allow an unauthenticated, adjacent attacker to bypass authentication and access critical internal services. The vulnerability is due to insufficient access restriction to ports necessary for system operation. An attacker could...

USN-4024-1: Evince update

As a security improvement, this update adjusts the AppArmor profile for the Evince thumbnailer to reduce access to the system and adjusts the AppArmor profile for Evince and Evince previewer to limit access to the DBus system bus. Additionally adjust the evince abstraction to disallow writes on...

PT-2019-8312

Name of the Vulnerable Software and Affected Versions Wireless IP Camera P2P WIFICAM cameras affected versions not specified Description The issue concerns Command Injection in the set ftp.cgi script via shell metacharacters in the pwd variable. This can be demonstrated by a "set...

[ASA-201906-4] chromium: multiple issues

Arch Linux Security Advisory ASA-201906-4 ========================================= Severity: Critical Date : 2019-06-07 CVE-ID : CVE-2019-5828 CVE-2019-5829 CVE-2019-5830 CVE-2019-5831 CVE-2019-5832 CVE-2019-5833 CVE-2019-5835 CVE-2019-5836 CVE-2019-5837 CVE-2019-5838 CVE-2019-5839 CVE-2019-5840...

OnApp CVE-2019-12491 Command Execution Vulnerability

Description OnApp is prone to a remote command-execution vulnerability. Successfully exploiting this issue may allow an attacker to execute arbitrary commands with root privileges in the context of the affected server. OnApp versions 5.0 prior to 5.0.0-88, 5.1 through 5.4, 5.5 prior to 5.5.0-93,...

PT-2019-16627 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.19 Description: The issue allows remote attackers to obtain sensitive information. This occurs because the software discloses the username when it receives a password-reset request that lacks the code parameter...

Cybozu Garoon 4.x.x <= 4.10.1 Multiple Vulnerabilities

Cybozu Garoon is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cybozu:garoon"; ifdescription...