Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM i

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM i. Vulnerability Details CVEID: CVE-2018-2964 DESCRIPTION: An unspecified vulnerability related to the Java SE Deployment component could allow an unauthenticated attacker to take control of the...

Integer overflow

Improper check in video driver while processing data from video firmware can lead to integer overflow and then buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,...

Buffer overflow

Possible buffer overwrite in message handler due to lack of validation of tid value calculated from packets received from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon...

kubernetes: Bearer tokens written to logs at high verbosity levels (>= 7)

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components such as kube-apiserver prior to v1.16.0, which make use of basic or bearer token authentication, and run ...

ASUS ZenFone Max 4 Access Control Error Vulnerability

The ASUS ZenFone Max 4 is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in the ASUS ZenFone Max 4. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could...

ASUS ZenFone 5 Lite Access Control Error Vulnerability

The ASUS ZenFone 5 Lite is a smartphone from Asus ASUS of Taiwan, China. An Access Control Error vulnerability exists in ASUS ZenFone 5 Lite. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could...

ASUS ZenFone 4 Selfie Access Control Error Vulnerability (CNVD-2020-14727)

The ASUS ZenFone 4 Selfie is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone 4 Selfie. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker coul...

ASUS ZenFone 5Q Access Control Error Vulnerability (CNVD-2020-14785)

The ASUS ZenFone 5Q is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in the ASUS ZenFone 5Q. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploi...

ASUS ZenFone Max 4 Access Control Error Vulnerability (CNVD-2020-14732)

The ASUS ZenFone Max 4 is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in the ASUS ZenFone Max 4. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could...

ASUS ASUS_A002 Access Control Error Vulnerability

The ASUS ASUSA002 is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ASUSA002. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit the...

ASUS ASUS_A002_2 Access Control Error Vulnerability

The ASUS ASUSA0022 is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ASUSA0022. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit the...

Enghouse Systems Web Chat Information Disclosure Vulnerability

Enghouse Systems Web Chat is a web-based online chat application from Enghouse Systems Canada. An information disclosure vulnerability exists in Enghouse Systems Web Chat version 6.2.284.34. The vulnerability stems from an error in configuration or other errors in the operation of a networked...

D-Link Router Privilege Escalation

The vulnerability of the components /etc/config/imagesign and /etc/alphaconfig/imagesign in the microprogramming software of D-Link DIR-600 B1, DIR-890L A1, DIR-615 J1, DIR-645 A1, DIR-815 A1, DIR-823 A1, and DIR-842 C1 is related to the use of pre-installed registration data. Exploiting this...

ASUS ZenFone 5Q Access Control Error Vulnerability

The ASUS ZenFone 5Q is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in the ASUS ZenFone 5Q. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploi...

ASUS ZenFone AR Access Control Error Vulnerability

The ASUS ZenFone AR is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone AR. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit th...

ASUS ASUS_X015_1 Access Control Error Vulnerability

The ASUS ASUSX0151 is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ASUSX0151. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit the...

Microsoft Graphics Components Unauthorized Access

The vulnerability of Microsoft Graphics Components in the Windows operating system is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Ansible Tower Information Disclosure Vulnerability (CNVD-2019-46772)

Ansible is a computer system configuration manager from the American company Ansible. The product can be used to publish, manage, and orchestrate computer systems.Ansible Tower is one of the task control applications that provides a user interface UI, dashboard, and REST API. Ansible Tower has an...

Threat Analysis Unit (TAU) Threat Intelligence Notification: Skidmap

Hijacking machine resources and using them to mine for cryptocurrency continues to be an attractive and lucrative target for threat actors. As we’ve continued to see this type of attack used, we’ve also seen more platforms being targeted. Seeing cryptocurrency mining malware targeting Linux and...

CVE-2019-9464

In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warning indicating an app accessed the user's location. This could dissolve the trust in the platform's permission system, with no additional execution privileges...