About the security content of macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

GitLab Omnibus 12.2.1 Logrotate Privilege Escalation Vulnerability

Gitlab Omnibus versions 7.4 through 12.2.1 suffer from a privilege escalation vulnerability that leverages a race condition in logrotate, resulting in a root shell. Privilege Escalation via Logrotate in Gitlab Omnibus Overview Target: GitLab Omnibus Vendor: GitLab Version: 7.4 through 12.2.1 Fixe...

CVE-2007-6688

Unspecified vulnerability in the Installation application in Menalto Gallery before 2.2.4 has unknown impact and attack vectors related to "web-accessibility protection of the storage folder."...

IDA, I Think It’s Time You And I Had a Talk: Controlling IDA Pro With Voice Control Software

Introduction This blog post is the next episode in the FireEye Labs Advanced Reverse Engineering FLARE team Script Series. Today, we are sharing something quite unusual. It is not a tool or a virtual machine distribution, nor is it a plugin or script for a popular reverse engineering tool or...

The vulnerability of the SwizzleData function in browsers like Firefox and Firefox ESR, as well as in the Thunderbird email client, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the SwizzleData function in browsers like Firefox and Firefox ESR, as well as in the Thunderbird email client, is caused by a numerical overflow condition. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of t...

'Narrator' Windows Utility Trojanized to Gain Full System Control

A suspected Chinese advanced persistent threat APT group has been spotted attacking tech companies using a trojanized screen-reader application, replacing the built-in Narrator “Ease of Access” feature in Windows. According to BlackBerry Cylance, the attackers also deploy a version of the...

KLA11741 Multiple vulnerabilities in Opera

Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, cause denial of service, spoof user interface, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Policy enforcement...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 77 to the Stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 77.0.3865.75 contains a number of fixes and improvements -- a full list of changes in this build is available in the log. Wat...

Cross-Site Scripting in selectize-plugin-a11y

Versions of selectize-plugin-a11y prior to 1.1.0 are vulnerable to Cross-Site Scripting. The accessibility.liveRegion.speak function does not sanitize the msg variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in ...

selectize-plugin-a11y cross-site scripting vulnerability

selectize-plugin-a11y is a plugin that sets the Selectize.js accessibile to Combobox. A cross-site scripting vulnerability exists in selectize-plugin-a11y versions prior to 1.1.0, which can be exploited by an attacker to execute client-side code...

CVE-2019-15482

selectize-plugin-a11y before 1.1.0 has XSS via the msg field...

Google Launches Open-Source Browser Extension for Ad Transparency

Google is launching an experimental, open-source browser extension aimed at increasing transparency around online advertising by displaying information about the ads that are shown to users. The browser extension is an integral part of a new Google initiative announced Thursday to develop a set o...

The vulnerability of the Windows EnterpriseDB database management system for PostgreSQL allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Windows EnterpriseDB database management system for PostgreSQL involves errors in code generation. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...

Microsoft Windows Text Services Framework MSCTF - Multiple Vulnerabilities

The msctf subsystem is part of the Text Services Framework, The TSF manages things like input methods, keyboard layouts, text processing and so on. There are two main components, the ctfmon server and the msctf client. The ctfmon service creates an ALPC port in a well known location, to which...

NewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0103)

The remote NewStart CGSL host, running version MAIN 4.05, has firefox packages installed that are affected by multiple vulnerabilities: - A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR...

CVE-2019-14924

GCDWebServer (before 3.5.3) is affected. The vulnerable component is GCDWebUploader’s moveItem, which validates FileExtension against newAbsolutePath but not oldAbsolutePath, enabling an attacker to make an inaccessible file (e.g., app credentials) accessible. Impact is information disclosure; no...

The vulnerability of UEFI (BIOS) software on HP workstations allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of UEFI BIOS software on HP workstations is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information, provided that the TPM module is disabled...

August 6, 2019, update for Office 2016 (KB4464588)

None None...

August 6, 2019, update for Office 2016 (KB3141456)

None None...

The vulnerability of the Core component in Oracle VM VirtualBox allows a hacker to influence the privacy, integrity, and accessibility of the protected information.

The vulnerability of the Core component in Oracle VM VirtualBox is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of information...