PT-2019-5396

Name of the Vulnerable Software and Affected Versions Easergy T300 versions 1.5.2 and older Description A vulnerability exists due to the use of platform-dependent third-party components with vulnerabilities in the Easergy T300. This could allow an attacker to exploit the component, potentially...

Hunting COM Objects (Part Two)

Background As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects. What is a COM Object? According to...

June 11, 2019—KB4503293 (OS Build 18362.175)

June 11, 2019—KB4503293 OS Build 18362.175 Applies To Windows 10, version 1903, all editions Windows Server version 1903 Note Note Follow @WindowsUpdate to find out when new content is published to the release information dashboard. Note This release also contains updates for Microsoft HoloLens O...

June 11, 2019—KB4503292 (Monthly Rollup)

June 11, 2019—KB4503292 Monthly Rollup Applies To Windows 7 Service Pack 1 Windows Server 2008 R2 Service Pack 1 Note Starting with KB4493472 Monthly Rollup updates will no longer include PciClearStaleCache.exe. This installation utility addressees inconsistencies in the internal PCI cache. This...

June 11, 2019—KB4503263 (Security-only update)

June 11, 2019—KB4503263 Security-only update Applies To Windows Server 2012 Windows Embedded 8 Standard Improvements and fixes This security update includes quality improvements. Key changes include: Addresses an issue that may prevent the Preboot Execution Environment PXE from starting a device...

HECI Subsystem Disclosure

The vulnerability of the HECI microprogramming software’s subsystem, including Intel Converged Security and Manageability Engine and Intel Server Platform Services, is related to the lack of protection for operational data. Exploiting this vulnerability can allow attackers to disclose sensitive...

PT-2019-2563 · Abb · Panel Builder 600 +15

Name of the Vulnerable Software and Affected Versions: ABB CP620 versions 1SAP520100R0001 through 1SAP520100R4001 ABB CP620-WEB version 1SAP520200R0001 ABB CP630 version 1SAP530100R0001 ABB CP630-WEB version 1SAP530200R0001 ABB CP635 versions 1SAP535100R0001 through 1SAP535100R5001 ABB CP635-B...

PT-2019-8013

Name of the Vulnerable Software and Affected Versions Orpak SiteOmat versions prior to 2017-09-25 Description A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution. Recommendations For versions prior to 2017-09-25, update to a version...

The Onion Router Information Disclosure Vulnerability

The Onion Router Tor is an implementation of Onion Routing. It is primarily used for anonymous access to the Internet. An information disclosure vulnerability exists in this version of Tor Browser prior to 8.0.1, which can be exploited by unauthorized attackers to obtain sensitive information abo...

CVE-2018-13925

Error in parsing PMT table frees the memory allocated for the map section but does not reset the context map section reference causing heap use after free issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT,...

Multiple Schneider Electric Products Information Disclosure Vulnerability (CNVD-2019-34828)

The Schneider Electric Modicon M580 is a programmable automation controller.The Schneider Electric Modicon Premium is a large programmable logic controller PLC for discrete or process applications.The Schneider Electric Modicon Quantum is a large programmable logic controller PLC for process...

mysql: Client programs unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocol...

Google bans Huawei from accessing Android & its licensed apps

By Uzair Amir Intel Corp., Broadcom Inc., Qualcomm Inc., Xilinx Inc., etc., have also refused to supply critical components and software to Huawei. The US has decided to deny Huawei Technologies Co., a major Chinese tech firm, access to US technology to prevent Huawei’s growing influence in the...

CVE-2019-12184: Improper Neutralization of Input During Web Page Generation

There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136...

PT-2019-12685

Name of the Vulnerable Software and Affected Versions Boostnote version 0.11.15 Description The issue is related to a XSS in the browser/components/MarkdownPreview.js component. It can be triggered via a label named flowchart, sequence, gallery, or chart. A crafted SRC attribute of an IFRAME...

Cisco NX-OS TLS Credential Verification

The vulnerability of the network operating system NX-OS for Cisco Nexus 9000 series routers is related to errors in verifying the authenticity of Transport Layer Security TLS certificates. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full control over all...

Microsoft SharePoint Server Information Disclosure Vulnerability (CNVD-2019-39023)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. An information...

Information Disclosure Vulnerability in Multiple Intel Products (CNVD-2019-22234)

Intel Xeon Scalable Processors are products of Intel Corporation.Intel Xeon Scalable Processors is a scalable server central processing unit CPU.Intel Xeon Processor E7 v4 Family is a Xeon E7 series server central processing unit CPU.Intel Xeon Processor E5 v4 Family is a Xeon E5 series server...

CVE-2019-0298

SAP E-Commerce Business-to-Consumer application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54...

CVE-2019-0298

SAP E-Commerce Business-to-Consumer application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54...