Security feature bypass

Application protection bypass vulnerability in McAfee Enterprise Security Manager ESM prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters...

Directory traversal

Directory Traversal vulnerability in McAfee Enterprise Security Manager ESM prior to 11.2.0 and prior to 10.4.0 allows authenticated user to gain elevated privileges via specially crafted input...

CVE-2019-3632

CVE-2019-3632 affects McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0. A directory traversal vulnerability allows an authenticated user to gain elevated privileges via specially crafted input, due to insufficient restrictions on path names. In practice, exploitation w...

CVE-2019-3631

McAfee Enterprise Security Manager (ESM) is affected by a command injection vulnerability (CVE-2019-3631) in versions prior to 11.2.0 and prior to 10.4.0. The issue arises from input that can be crafted by anAuthenticated user to cause arbitrary code execution. Impact is described as remote code ...

CVE-2019-3630 Command Injection could allow authenticated users to execute arbitrary code

Command Injection vulnerability in McAfee Enterprise Security Manager ESM prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters...

CVE-2019-3630

CVE-2019-3630 affects McAfee Enterprise Security Manager (ESM). An authenticated user can trigger a command injection via specially crafted parameters, allowing execution of arbitrary code on affected systems. Affected versions are ESM prior to 11.2.0 and prior to 10.4.0. The vulnerability stems ...

CVE-2019-3629 Application protections bypass vulnerability could allow unauthenticated user to impersonate system users

Application protection bypass vulnerability in McAfee Enterprise Security Manager ESM prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters...

CVE-2019-3629

McAfee Enterprise Security Manager (ESM) has an authorization issue that allows an unauthenticated user to impersonate system users via specially crafted parameters. Affected versions are ESM prior to 11.2.0 and prior to 10.4.0. This is a protection bypass vulnerability in the application itself....

Privilege escalation

Privilege escalation in McAfee Enterprise Security Manager ESM 11.x prior to 11.2.0 allows authenticated user to gain access to a core system component via incorrect access control...

CVE-2019-3628

CVE-2019-3628 affects McAfee Enterprise Security Manager (ESM) 11.x before 11.2.0. An authenticated user can exploit incorrect access control to escalate privileges and access a core system component. Impact is described as privilege escalation with access to core components; remediation is to up...

CVE-2019-3628 Privilege escalation could allow authenticated user to gain access to a core system

Privilege escalation in McAfee Enterprise Security Manager ESM 11.x prior to 11.2.0 allows authenticated user to gain access to a core system component via incorrect access control...

USN-4038-2 bzip2 vulnerabilities

USN-4038-1 fixed several vulnerabilities in bzip2. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Aladdin Mubaied discovered that bzip2 incorrectly handled certain files. An attacker could possibly use this issue to cause a deni...

USN-4037-1: policykit-desktop-privileges update

The policykit-desktop-privileges Startup Disk Creator policy allowed administrative users to overwrite disks. As a security improvement, this operation now requires authentication...

USN-4030-1: web2py vulnerabilities

It was discovered that web2py does not properly check denied hosts before verifying passwords. An attacker could possibly use this issue to perform brute-force attacks. CVE-2016-10321 It was discovered that web2py allows remote attackers to obtain environment variable values. An attacker could...

GHSA-QX4V-6GC5-F2VV Regular Expression Denial of Service

A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop...

Regular Expression Denial of Service

A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop...

USN-4023-1: Mosquitto vulnerabilities

It was discovered that Mosquitto broker incorrectly handled certain specially crafted input and network packets. A remote attacker could use this to cause a denial of service...

USN-4024-1: Evince update

As a security improvement, this update adjusts the AppArmor profile for the Evince thumbnailer to reduce access to the system and adjusts the AppArmor profile for Evince and Evince previewer to limit access to the DBus system bus. Additionally adjust the evince abstraction to disallow writes on...

USN-4020-1: Firefox vulnerability

A type confusion bug was discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could exploit this by causing a denial of service, or executing arbitrary code...

USN-4019-1: SQLite vulnerabilities

It was discovered that SQLite incorrectly handled certain SQL files. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2017-2518, CVE-2017-2520 It was discovered that SQLite incorrectly handled certain...