CVE-2018-11788

Apache Karaf contains an XXE vulnerability in its XMLInputFactory used by the features deployer. The XMLInputFactory does not implement mitigation against external entities, enabling potential XML External Entity Injection in Karaf versions prior to 4.1.7 and prior to 4.2.2. First fixed in Karaf ...

CVE-2018-11788

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a...

January 8, 2019—KB4483203 Update for Windows 10 Mobile (OS Build 15254.547)

January 8, 2019—KB4483203 Update for Windows 10 Mobile OS Build 15254.547 Improvements and fixes This update includes quality improvements. No new operating system features are being introduced in this update. Key changes include: This build includes all the improvements from KB4480973. If you...

Fedora 28 : kernel / kernel-tools (2018-2c6bd93875)

The 4.17.2 kernel rebase contains new drivers, new features, and a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it...

Fedora 29 : mongo-c-driver (2018-2f8f5f75f1)

libbson 1.13.0 Features: - New functions to save and restore progress of a bsonitert: bsoniterkeylen, bsoniteroffset, and soniterinitfromdataatoffset Additional functions bsoniteroverwritedatetime, bsoniteroverwriteoid, and bsoniteroverwritetimestamp. All fixed-length BSON values can now be updat...

Fedora 28 : mkvtoolnix (2018-317ecbb54f)

Version 28.2.0 'The Awakening' 2018-10-25 Bug fixes - mkvmerge, mkvinfo, mkvextract, mkvpropedit, MKVToolNix GUI's info tool & chapter editor: fixed a case of memory being accessed after it had been freed earlier. This can be triggered by specially crafted Matroska files and lead to arbitrary cod...

Fedora 28 : libvirt (2018-527698a904) (Spectre)

Add new CPU features for speculative store bypass CVE-2018-3639 On Intel x86 hosts, the 'ssbd' feature must be explicitly added to any virtual machines that are not using host-passthrough/host-model CPU setup. NB this requires new microcode too, which is not yet available in Fedora microcodectl...

SUSE SLES12 Security Update : slurm (SUSE-SU-2017:3311-1)

This update for slurm fixes the following issues: Slurm was updated to 17.02.9 to fix a security bug, bringing new features and bugfixes fate323998 bsc1067580. Security issue fixed : - CVE-2017-15566: Fix security issue in Prolog and Epilog by always prepending SPANK to all user-set environment...

[SECURITY] Fedora 28 Update: phpMyAdmin-4.8.4-1.fc28

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

New Delegated Administration feature in Enterprise Threat Protector

Managing security configurations for large organizations with locations scattered around the world can be challenging. Likewise, some businesses have multiple operating divisions that are separate entities but all use the same IT infrastructure. As an IT leader, you likely want to have consistenc...

Multiple vulnerabilities in Toshiba Lighting & Technology Corporation Home gateway

Overview Home gateway provided by Toshiba Lighting & Technology Corporation contains multiple vulnerabilities listed below. Improper access control CWE-284 - CVE-2018-16197 Hidden functionality CWE-912 - CVE-2018-16198 Cross-site scripting CWE-79 - CVE-2018-16199 OS command injection CWE-78 -...

3S-Smart Software Solutions GmbH CODESYS Control V3 Products

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : 3S-Smart Software Solutions GmbH Equipment : CODESYS Control V3 products Vulnerability : Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...

Kaspersky: Certificate warnings and similar UI elements in Web protection of Anti-Virus products family are susceptible to clickjacking

Summary Clickjacking can be used to trick users into overriding certificate warnings, disabling Safe Money functionality or phishing alerts. Description On certificate warning pages, a single click is sufficient to trigger overriding a wrong certificate. While an additional warning is displayed...

Security update for Chromium (important)

This update to Chromium 71.0.3578.98 fixes the following issues: Security issues fixed boo1118529: - CVE-2018-17480: Out of bounds write in V8 - CVE-2018-17481: Use after frees in PDFium - CVE-2018-18335: Heap buffer overflow in Skia - CVE-2018-18336: Use after free in PDFium - CVE-2018-18337: Us...

Microsoft Team Foundation Server 2010 Service Pack 1

Describes the Microsoft Team Foundation Server 2010 Service Pack 1 new features and issues that are fixed by the service pack.SummaryThis article describes information about Team Foundation Server TFS 2010 Service Pack 1 SP1. The largest component of the TFS 2010 SP1 is the set of core product...

Cumulative Update 38 for Microsoft Dynamics NAV 2016 (Build 50785)

Cumulative Update 38 for Microsoft Dynamics NAV 2016 Build 50785 This article applies to Microsoft Dynamics NAV 2016 for all countries and all language locales. Overview This cumulative update includes all hotfixes and regulatory features that have been released for Microsoft Dynamics NAV 2016,...

Cumulative Update 25 for Microsoft Dynamics NAV 2017 (Build 26396)

Cumulative Update 25 for Microsoft Dynamics NAV 2017 Build 26396 This article applies to Microsoft Dynamics NAV 2017 for all countries and all language locales. Overview This cumulative update includes all hotfixes and regulatory features that have been released for Microsoft Dynamics NAV 2017,...

Description of the security update for SharePoint Enterprise Server 2016: December 11, 2018

None None...

WordPress CodeCanyon-5293356-Ajax-Store-Locator-Wordpress 1.2.0 Disclosure

Exploit Title : WordPress CodeCanyon-5293356-Ajax-Store-Locator-Wordpress Plugins 1.2.0 Multiple Vulnerabilities Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 10/12/2018 Vendor Homepage : wordpress.org codecanyon.net/item/ajax-store-locator-v-20/4106209?srank=1 ...

Lawsuit Claims Pegasus Spyware Helped Saudis Spy on Khashoggi

A well-known Saudi dissident previously targeted by the notorious Pegasus spyware has filed a lawsuit against that spyware’s authors, Israel-based NSO Group. The suit claims that Pegasus was instrumental in the Saudi government’s surveillance of Washington Post journalist Jamal Khashoggi leading ...