Information Disclosure

PHP is vulnerable to information disclosure. It has dumpable FPM child processes which allow bypassing opcache access controls because fpmunix.c calls PRSETDUMPABLE prctl...

Google Android System Component Multiple Security Vulnerabilities

Description Google Android is prone to the following security vulnerabilities: 1. Multiple remote code-execution vulnerabilities. 2. Multiple remote privilege-escalation vulnerabilities. 3. Multiple information-disclosure vulnerabilities. 4. Multiple denial-of-service vulnerability An attacker...

Google Android Media Framework Component Multiple Security Vulnerabilities

Description Google Android is prone to the following security vulnerabilities: 1. Multiple remote-code execution vulnerabilities 2. Multiple privilege-escalation vulnerabilities 3. Multiple information-disclosure vulnerabilities 4. Multiple denial of service vulnerabilities An attacker can...

Debian DLA-1891-1 : openldap security update

Several security vulnerabilities were discovered in openldap, a server and tools to provide a standalone directory service. CVE-2019-13057 When the server administrator delegates rootDN database admin privileges for certain databases but wants to maintain isolation e.g., for multi-tenant...

[SECURITY] [DLA 1891-1] openldap security update

Package : openldap Version : 2.4.40+dfsg-1+deb8u5 CVE ID : CVE-2019-13057 CVE-2019-13565 Debian Bug : 932997 932998 Several security vulnerabilities were discovered in openldap, a server and tools to provide a standalone directory service. CVE-2019-13057 When the server administrator delegates...

CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

CVE-2019-7904

CVE-2019-7904 affects Magento versions prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2, where a low-privileged user could make unauthorized environment configuration changes due to insufficient enforcement of user access controls. Public references indicate a security update exists: M...

CVE-2019-7904

Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes...

Security Fundamentals Are Key To Successful Cloud Migration

Earlier I wrote about the importance of patching, or more accurately the importance of transferring the need to patch & the associated risk to someone else by using their cloud security service. While patching definitely falls into the security fundamentals category it remains as relevant as ever...

PT-2019-7144 · Red Hat · Foreman

Name of the Vulnerable Software and Affected Versions: foreman versions 1.x.x before 1.15.6 Description: The issue is related to improper enforcement of access controls on certain resources in foreman, within Satellite 6. An attacker with access to the API and knowledge of the resource name can...

Schneider Electric Pelco Endura NET55XX Encoder - Authentication Bypass Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Schneider Electric Pelco Endura NET55XX Encoder", 'Description' = %q This module exploits inadequate access controls within the webUI to enable t...

Schneider Electric Pelco Endura NET55XX Encoder

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Schneider Electric Pelco Endura NET55XX Encoder", 'Description' = %q This module exploits inadequate access controls within the webUI to enable...

CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

Authorization

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

CVE-2019-13565

CVE-2019-13565 affects OpenLDAP 2.x before 2.4.48. The issue arises when using SASL authentication with session encryption and relying on SASL security layers in slapd ACLs, allowing access that would normally be denied via a simple bind for identities covered by the ACLs. After the first SASL bi...

UBUNTU-CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

Sonatype Nexus Repository Manager Missing Access Controls RCE

The Sonatype Nexus Repository Manager server application running on the remote host is version 3.x prior to 3.15.0. It is, therefore, affected by a remote code execution vulnerability due to insufficient access controls. An unauthenticated, remote attacker can exploit this to bypass authenticatio...

CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...