Design/Logic Flaw

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

The vulnerability of the Skype instant messaging application for Android operating systems allows attackers to disclose protected information.

The vulnerability of the Skype instant messaging application for Android operating systems is related to errors in processing incoming calls. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Authentication flaw

The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls without authentication, as demonstrated by retrieving password hashes via an inc/utils/RESTAPI.php?command=CallAPI&customurl=alladminusers...

CVE-2019-9105

The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls without authentication, as demonstrated by retrieving password hashes via an inc/utils/RESTAPI.php?command=CallAPI&customurl=alladminusers...

CVE-2019-9105

The CVE-2019-9105 entry concerns WebApp v04.68 on SAET Impianti Speciali TEBE Small 05.01 build 1137 shown as vulnerable to unauthenticated API calls, demonstrated by returning password hashes via inc/utils/REST_API.php?command=CallAPI&customurl=alladminusers. Connected documents corroborate an a...

Unsafe entry in Script Security list of approved signatures in workflow-remote-loader

workflow-remote-loader provides a custom list of pre-approved signatures for Script Security. Those entries apply to all scripts with sandbox protection, such as Pipeline. One entry provided here was unsafe, as it allowed invoking arbitrary methods, bypassing sandbox protection. The unsafe...

The vulnerability of the Event Management Service daemon (emsd) on the Cisco IOS XR operating system allows a hacker to trigger a service failure.

The vulnerability of the Event Management Service daemon emsd on the Cisco IOS XR operating system is related to insufficient validation of input data during gRPC requests. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially crafted gRPC requests...

Ubuntu: Security Advisory (USN-4001-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2019-2632 · Gnome +7 · Gnome Gvfs +7

Name of the Vulnerable Software and Affected Versions: GNOME gvfs versions prior to 1.38.3 GNOME gvfs versions 1.40.x prior to 1.40.2 GNOME gvfs versions 1.41.x prior to 1.41.3 Description: The issue is related to errors in the authorization procedure of the GVFS subsystem in the GNOME desktop...

Insecure Access Controls

novajoin uses insecure access controls. The lack of access controls allows an attacker to generate tokens from authenticated users to gain access to HTTP calls to the API...

JDK: missing null check when accelerating Unsafe calls

In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. A local authenticated attacker could cause a null pointer dereference in dccpwritexmit leads to a system crash via crafted system calls...

Arbitrary File Write

pcs is vulnerable to arbitrary file write attacks. An authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process via malicious REST calls...

The vulnerability of the mempcpy function in libraries that handle system calls and core glibc functions allows a hacker to execute arbitrary code.

The vulnerability of the mempcpy function in the library that handles system calls and core functions of glibc is caused by a numerical overflow. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability in the implementation of the mempcpy function in libraries that handle system calls and core glibc functions allows a perpetrator to cause a service failure.

The vulnerability in the implementation of the mempcpy function in libraries that handle system calls and core glibc functions arises due to buffer overflow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2018-19838

In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENTASTOPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone, cloneChildren, and copy...

rubygems: Escape sequence injection vulnerability in verbose

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteractionverbose calls say without escaping, escape sequence injection is possible...

EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1500)

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The IPv6 DCCP implementation in the Linux kernel mishandles inheritance, which allows local users to cause a denial of...

Detecting credential theft through memory access modelling with Microsoft Defender ATP

Stealing user credentials is a key step for attackers to move laterally across victim networks. In today’s attacks, we see a range of tools used to achieve credential theft, requiring protections that target the root behavior and not just individual known tools as is often done by traditional...