PT-2019-13472

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 77.0.3865.75 Description A use-after-free issue in the accessibility feature of Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Recommendations For version...

Cross-Site Scripting in selectize-plugin-a11y

Versions of selectize-plugin-a11y prior to 1.1.0 are vulnerable to Cross-Site Scripting. The accessibility.liveRegion.speak function does not sanitize the msg variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in ...

selectize-plugin-a11y cross-site scripting vulnerability

selectize-plugin-a11y is a plugin that sets the Selectize.js accessibile to Combobox. A cross-site scripting vulnerability exists in selectize-plugin-a11y versions prior to 1.1.0, which can be exploited by an attacker to execute client-side code...

CVE-2019-15482

selectize-plugin-a11y before 1.1.0 has XSS via the msg field...

Google Launches Open-Source Browser Extension for Ad Transparency

Google is launching an experimental, open-source browser extension aimed at increasing transparency around online advertising by displaying information about the ads that are shown to users. The browser extension is an integral part of a new Google initiative announced Thursday to develop a set o...

Windows EnterpriseDB Data Compromise

The vulnerability of the Windows EnterpriseDB database management system for PostgreSQL involves errors in code generation. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...

Microsoft Windows Text Services Framework MSCTF - Multiple Vulnerabilities

The msctf subsystem is part of the Text Services Framework, The TSF manages things like input methods, keyboard layouts, text processing and so on. There are two main components, the ctfmon server and the msctf client. The ctfmon service creates an ALPC port in a well known location, to which...

NewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0103)

The remote NewStart CGSL host, running version MAIN 4.05, has firefox packages installed that are affected by multiple vulnerabilities: - A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR...

CVE-2019-14924

GCDWebServer (before 3.5.3) is affected. The vulnerable component is GCDWebUploader’s moveItem, which validates FileExtension against newAbsolutePath but not oldAbsolutePath, enabling an attacker to make an inaccessible file (e.g., app credentials) accessible. Impact is information disclosure; no...

UEFI BIOS Compromise

The vulnerability of UEFI BIOS software on HP workstations is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information, provided that the TPM module is disabled...

August 6, 2019, update for Office 2016 (KB3141456)

None None...

August 6, 2019, update for Office 2016 (KB4464588)

None None...

Oracle VM VirtualBox Privilege Escalation

The vulnerability of the Core component in Oracle VM VirtualBox is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of information...

Unique Monokle Android Spyware Self-Signs Certificates

A never-before-publicized mobile spy tool, a mobile surveillanceware remote access trojan RAT for Android called Monokle, has been spotted using novel techniques to exfiltrate data. According to the Lookout researchers who discovered Monokle in the wild, the malware has the ability to self-sign...

GVFS daemon/gvfsbackendadmin.c Data Compromise

The vulnerability of the daemon/gvfsbackendadmin.c component in the GVFS subsystem of GNOME desktop environments on Linux operating systems arises from the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability allows an attacker to compromise...

Slurm Access Control Compromise

The vulnerability of the Slurm resource manager is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...

Mobile app building is simple and affordable – the Appy Pie way!

By Owais Sultan Steve Jobs had it right! There is an app for everything and businesses today, big and small, are realizing it. Mobile apps, in their limited time of existence, have made a massive impact on the industry and creating mobile apps is not limited to just the big leagues. This is a pos...

June 27, 2019 — KB4502584 Cumulative Update for .NET Framework 3.5, 4.8 for Windows 10, version 1903 and Windows Server 1903 RTM

None None...

PostgreSQL Access Control Compromise

The vulnerability of the PostgreSQL database management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2019-2091

In GetPermittedAccessibilityServicesForUser of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege, with no additional permissions required. User interaction is not needed for exploitation...