PT-2019-1936

Name of the Vulnerable Software and Affected Versions Oracle Outside In Technology versions 8.5.3 through 8.5.4 Description The issue is related to insufficient access controls in the Outside In Filters subcomponent of Oracle Outside In Technology, a suite of software development kits SDKs. This...

Cisco RV325 < 1.4.2.22 Multiple Vulnerabilities

Binary data 700567.prm...

PT-2019-1935

Name of the Vulnerable Software and Affected Versions Oracle Outside In Technology versions 8.5.3 through 8.5.4 Description The issue is related to insufficient access controls in the Outside In Filters subcomponent of Oracle Outside In Technology, a suite of software development kits SDKs. This...

PT-2019-1925

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3, 12.2.3 through 12.2.8 Description The issue is related to insufficient access controls in the Renewals subcomponent of Oracle Service Contracts, part of the Oracle E-Business Suite system...

UBUNTU-CVE-2019-11236

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter...

Cisco Small Business RV320 and RV325 Routers Multiple Vulnerabilities (cisco-sa-20190123-rv-inject, cisco-sa-20190123-rv-info)

According to its self-reported version, this Cisco Small Business RV Series router is affected by multiple vulnerabilities: - A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker wi...

CVE-2019-9696

Symantec VIP Enterprise Gateway all versions may be susceptible to a cross-site scripting XSS exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentiall...

CVE-2018-14894

CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker who is able to edit permissions of a file to bypass intended access restrictions and execute blocked applications...

CVE-2018-19589

Incorrect Access Controls of Security Officer SO in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in...

CVE-2018-19589

Incorrect Access Controls of Security Officer SO in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in...

CVE-2018-19589

The CVE-2018-19589 describes incorrect access controls in the PKCS11 R2 provider shipping with Utimaco CryptoServer HSM. An SO authenticated to a slot can retrieve attributes of keys marked as private in external key storage and can delete such keys, potentially compromising availability of all e...

CVE-2018-19589: Incorrect Permission Assignment for Critical Resource

Incorrect Access Controls of Security Officer SO in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in...

PT-2019-9871

Name of the Vulnerable Software and Affected Versions Utimaco CryptoServer HSM affected versions not specified Description The issue concerns incorrect access controls in the PKCS11 R2 provider of the Utimaco CryptoServer HSM product package. This allows a Security Officer SO authenticated to a...

MyCar Controls uses hard-coded credentials

Overview The MyCar Controls mobile applications prior to v3.4.24 on iOS and prior to v4.1.2 on Android contains hard-coded admin credentials. Description MyCar is a small aftermarket telematics unit from AutoMobility Distribution Inc. MyCar add smartphone-controlled geolocation, remote start/stop...

CVE-2018-4324

A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macOS Mojave 10.14...

CVE-2018-4324

A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macOS Mojave 10.14...

Design/Logic Flaw

A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macOS Mojave 10.14...

CVE-2018-4324

A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macOS Mojave 10.14...

CVE-2018-4324

CVE-2018-4324 relates to macOS before Mojave 10.14, in the App Store component handling of the Apple ID. The issue is described as a permissions/access-control failure that could enable an attacker to determine the owner’s Apple ID via a malicious app, with the fix being improved access controls ...

SANS Reviews the CB Predictive Security Cloud

Understanding The Landscape Day by day, it is becoming more challenging to keep endpoints secure. In the SANS “Endpoint Protection and Response” survey from 2018, 42% of respondents indicated at least one of their endpoints had been compromised, and another 20% didn’t know if any endpoints had be...