1573 matches found
SUSE-SU-2019:0719-1 Security update for ghostscript
This update for ghostscript fixes the following issue: Security issue fixed: - CVE-2019-3838: Fixed a vulnerability which made forceput operator in DefineResource to be still accessible which could allow access to file system outside of the constraints of -dSAFER bsc1129186...
SUSE-SU-2019:0718-1 Security update for ghostscript
This update for ghostscript fixes the following issue: Security issue fixed: - CVE-2019-3838: Fixed a vulnerability which made forceput operator in DefineResource to be still accessible which could allow access to file system outside of the constraints of -dSAFER bsc1129186...
ghostscript: superexec operator is available (700585)
It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER...
CVE-2019-3835
It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Mitigation Please refer to the "Mitigation" section of...
CVE-2019-3835
It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER...
Design/Logic Flaw
An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java,...
CVE-2019-1003038: Insufficiently Protected Credentials
An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java,...
PT-2019-1696
Name of the Vulnerable Software and Affected Versions Ghostscript versions prior to 9.27 Description The issue is related to insecure privilege management in the DefineResource method of the Ghostscript file conversion program. Exploitation of this issue could allow a remote attacker to elevate...
PT-2019-1695
Name of the Vulnerable Software and Affected Versions Ghostscript versions prior to 9.27 Description The issue is related to the superexec operator being available in the internal dictionary in Ghostscript, which could allow a specially crafted PostScript file to access the file system outside of...
GHSA-CXMJ-QJV6-VX9P mcstatic directory traversal vulnerability
A server directory traversal vulnerability was found on node module mcstatic =0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path...
PT-2019-2588
Name of the Vulnerable Software and Affected Versions Ghostscript versions prior to 9.27 Description The issue is related to the incorrect usage of privileged APIs in the Ghostscript PostScript file conversion program. Exploitation of this issue may allow a remote attacker to access the file...
CVE-2018-16482
A server directory traversal vulnerability was found on node module mcstatic =0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path...
CVE-2018-16482: Improper Limitation of a Pathname to a Restricted Directory
A server directory traversal vulnerability was found on node module mcstatic =0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path...
ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)
It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator pushes a subroutine. A specially crafted PostScript file could use this flaw to escape the -dSAFER protection in order to, for example, have access to the file system outside of the SAFER...
Artifex Software Ghostscript Sandbox Bypass Vulnerability
Artifex Software Ghostscript is an open source Postscript a page description language and programming language used in the electronics industry and desktop publishing parser from Artifex Software that displays Postscript files and prints them on non-Postscript printers. print Postscript files on...
January 15, 2019âKB4480976 (OS Build 17134.556)
None None...
CVE-2018-4043: Improper Input Validation
An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to improper input validation. A user with local access can use this vulnerability to modify the file system as root. An attacker would need local access to the machine for a successful...
CVE-2018-1000425
An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube...
CVE-2018-1000423
An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2...
CVE-2018-1000425
An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube...