PT-2019-13187 · Nothinq · Stb Vorbis

Name of the Vulnerable Software and Affected Versions: stb vorbis versions through 2019-03-04 Description: The issue is related to the use of uninitialized stack variables in the start decoder function, which can be exploited by opening a crafted Ogg Vorbis file. This can lead to a denial of...

Microsoft Font Subsetting - DLL Heap-Based Out-of-Bounds read in WriteTableFromStructure

Microsoft Font Subsetting - DLL Heap-Based Out-of-Bounds read in WriteTableFromStructure -----===== Background =====----- The Microsoft Font Subsetting DLL fontsub.dll is a default Windows helper library for subsetting TTF fonts; i.e. converting fonts to their more compact versions based on the...

Microsoft Font Subsetting - DLL Heap-Based Out-of-Bounds read in FixSbitSubTableFormat1

-----===== Background =====----- The Microsoft Font Subsetting DLL fontsub.dll is a default Windows helper library for subsetting TTF fonts; i.e. converting fonts to their more compact versions based on the specific glyphs used in the document where the fonts are embedded. It is used by Windows G...

Information disclosure

Unencrypted communication error in SAP Business Objects Business Intelligence Platform Central Management Console, version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure...

PT-2019-3003 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Graphics Component affected versions not specified Description: The issue is related to errors in handling objects in memory by the Windows Graphics Component. This can allow an attacker to disclose protected information usi...

NewStart CGSL MAIN 4.06 : qemu-kvm Multiple Vulnerabilities (NS-SA-2019-0091)

The remote NewStart CGSL host, running version MAIN 4.06, has qemu-kvm packages installed that are affected by multiple vulnerabilities: - Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation i...

CVE-2019-5498

OnCommand Insight up to version 7.3.6 contains an information-disclosure vulnerability that could reveal sensitive account information to an authenticated user. This is documented across multiple sources (NVD and Red Hat/CVE entries) with the root cause described as an issue in how the product ha...

IBM Business Process Manager and IBM Business Automation Workflow XML External Entity Injection Vulnerability

IBM Business Process Manager BPM and IBM Business Automation Workflow are both products of IBM Corporation, U.S.A. IBM Business Process Manager is a comprehensive business process management platform. The platform provides a series of related tools for business process modeling, assembly,...

IBM Security Identity Manager XML External Entity Injection Vulnerability

IBM Security Identity Manager from IBM is a policy-based, automated solution that manages user access across IT environments and helps drive effective identity management and governance across the enterprise. An XML external entity injection vulnerability exists in IBM Security Identity Manager...

The vulnerability of the GetPixelChannel function in the ImageMagick console-based graphics editor allows a hacker to cause a service failure or expose protected information.

The vulnerability of the GetPixelChannel function in the ImageMagick Core/pixel-accessor.h file is related to reading data beyond the buffer boundaries in dynamic memory. Exploiting this vulnerability could allow an attacker to cause service failures or disclose sensitive information through a...

The vulnerability of the ComplexImages function in the console-based graphic editor ImageMagick, which allows a hacker to cause a service failure or expose protected information

The vulnerability of the ComplexImages function MagickCore/fourier.c in the console-based graphic editor ImageMagick involves reading beyond the buffer boundaries in dynamic memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or disclose protected informati...

The vulnerability of HP Color LaserJet Pro and HP LaserJet Pro printer software, related to the falsification of inter-site requests, allows a perpetrator to disclose protected information or cause service failures.

The vulnerability of HP Color LaserJet Pro and HP LaserJet Pro printer software relates to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service failures...

The vulnerability of the urllib.parse.urlsplit and urllib.parse.urlparse functions in the Python interpreter allows a attacker to disclose protected information, read or write arbitrary data, or cause a denial-of-service attack.

The vulnerability of the urllib.parse.urlsplit and urllib.parse.urlparse functions in the Python interpreter is related to errors in handling registration data. Exploiting this vulnerability can allow an attacker to disclose sensitive information, read or write arbitrary data, or cause service...

CVE-2019-1125

An information disclosure vulnerability exists when certain central processing units CPU speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability, an attacker would have to log on to an...

The vulnerability of the Linux operating system’s kernel allows a hacker to trigger a service failure and obtain confidential information.

The vulnerability in the driver /infiniband/core/uverbsmain.c of Linux operating systems arises due to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to obtain confidential information or cause service failures...

IBM Intelligent Operations Center XML External Entity Injection Vulnerability

IBM Intelligent Operations Center IOC is a suite of city operations solutions from IBM in the United States. The product features data visualization and real-time collaboration. An XML external entity injection vulnerability exists in IBM IOC, which can be exploited by remote attackers to disclos...

CVE-2019-9140

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a...

PT-2020-6191 · Openjpeg +9 · Openjpeg2 +9

Name of the Vulnerable Software and Affected Versions: openjpeg2 affected versions not specified Description: A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. This issue could allow an attacker to cause an application crash or, in some cases, execute arbitra...

GNU Binutils Input Validation Error Vulnerability

GNU Binutils GNU Binary Utilities or binutils is a set of programming language utility programs developed by the GNU Project. The programs are primarily designed to work with target files in a variety of formats, and provide connectors, assemblers, and other tools for target files and archives. A...

The vulnerability of the Core RDBMS component of the database management system Oracle Database Server allows attackers to disclose sensitive information.

The vulnerability of the Core RDBMS component of the database management system Oracle Database Server is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security measures...