MGASA-2019-0389 Updated libcroco packages fix security vulnerability

Updated libcroco packages fix security vulnerabilities: Heap overflow input: check end of input before reading a byte CVE-2017-7960. Undefined behavior tknzr: support only max long rgb values CVE-2017-7961. Denial of service memory allocation error via a crafted CSS file CVE-2017-8834. Denial of...

CVE-2019-5235

Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal...

CVE-2019-5258

Certain Huawei products AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981 have a buffer overflow vulnerability. An attacker who logs in to the board may...

CVE-2019-5254

Certain Huawei products AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981 have an out-of-bounds read vulnerability. An attacker who logs in to the board...

Out-of-bounds

Certain Huawei products AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981 have an out-of-bounds read vulnerability. An attacker who logs in to the board...

CVE-2019-5254

CVE-2019-5254 is an out-of-bounds read vulnerability affecting multiple Huawei products (AP2000; IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; S5700; SVN5600; SVN5800; SVN5800-C; SeMG9811; Secospace AntiDDoS8000; Secospace USG6300/USG6500/USG6600; USG6000V; eSpace U1981). The root cause is ...

CVE-2019-5235: NULL Pointer Dereference

Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal...

CVE-2019-13931

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web interface could allow for an an attacker to craft the input in a form that is not expected, causing the application to behave in unexpected ways for legitimate users. Successful exploitation requires for an attacker to be...

CVE-2019-13931

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web interface could allow for an an attacker to craft the input in a form that is not expected, causing the application to behave in unexpected ways for legitimate users. Successful exploitation requires for an attacker to be...

Code injection

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web interface could allow for an an attacker to craft the input in a form that is not expected, causing the application to behave in unexpected ways for legitimate users. Successful exploitation requires for an attacker to be...

CVE-2019-13931

Siemens XHQ Operations Intelligence (all versions

Weak Password Vulnerability in Tianrongxin Internet Behavior Management System

TIANRONGXIN Internet Behavior Management System is a professional product of TIANRONGXIN to meet the needs of network behavior management and content auditing in various industries based on years of experience in research and development of security products. Tianrongxin Internet Behavior...

Unspecified Vulnerability in Siemens XHQ

Siemens XHQ Production Operations Intelligence is Siemens Energy's flagship solution and is widely deployed by the world's largest oil & gas and chemical companies. An unspecified vulnerability exists in Siemens XHQ, which can be exploited by an attacker to cause an application to run in an...

Threat Analysis Unit (TAU) Threat Intelligence Notification: njRAT

njRAT is a Remote Access Trojan RAT that will silently collect and steal sensitive information such as login credentials. It can also perform keylogger monitoring, remote desktop control, installing additional malicious software, and many other malicious activities on the victim’s computer. In...

The vulnerability in the implementation of the Page.downloadBehavior backend of the Google Chrome browser allows a hacker to persuade users to install a malicious extension.

The vulnerability of the PagedownloadBehavior implementation in Google Chrome’s browser lies in the lack of restrictions on file downloads. Exploiting this vulnerability can allow a malicious actor to persuade a user to install a malicious extension through a specially created HTML page...

SYSTEM token impersonation through NTLM bits authentication on missing WinRM Service.

This module exploit BITS behavior which tries to connect to the local Windows Remote Management server WinRM every times it starts. The module launches a fake WinRM server which listen on port 5985 and triggers BITS. When BITS starts, it tries to authenticate to the Rogue WinRM server, which allo...

A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack

Keepalive thread overload/DoS Impact A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the...

GHSA-7XX3-M584-X994 A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack

Keepalive thread overload/DoS Impact A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the...

EulerOS 2.0 SP2 : binutils (EulerOS-SA-2019-2450)

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++...

CVE-2019-10174

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the...