kernel: brcmfmac frame validation bypass

If the brcmfmac driver receives a firmware event frame from a remote source, the iswlceventframe function will cause this frame to be discarded and not be processed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be...

kernel: brcmfmac frame validation bypass

If the brcmfmac driver receives a firmware event frame from a remote source, the iswlceventframe function will cause this frame to be discarded and not be processed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be...

PT-2019-4181

Name of the Vulnerable Software and Affected Versions hostapd versions prior to 2.10 wpa supplicant versions prior to 2.10 Description The issue is related to a denial of service caused by mishandled source address validation, which should have been prevented by management frame protection. An...

CVE-2019-16275: Origin Validation Error

hostapd before 2.10 and wpasupplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF aka management frame protection. The attacker must send a...

CVE-2019-16193

In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting XFS attack through the EDIT MY PROFILE feature...

CVE-2019-16193

In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting XFS attack through the EDIT MY PROFILE feature...

CVE-2019-16193

CVE-2019-16193 affects ArcGIS Enterprise 10.6.1. A crafted IFRAME can trigger a Cross Frame Scripting (XFS) attack via the EDIT MY PROFILE feature. Public records (NVD) cite CVSS v2 base 3.5 (LOW) and CVSS v3.1 base 5.4 (MEDIUM); attack vector: NETWORK, user interaction required (CVSS3.1), and pa...

CVE-2019-16193

In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting XFS attack through the EDIT MY PROFILE feature...

PT-2019-6454

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.2 Description The issue is related to a memory leak in the filter frame function of the vf tile.c component in the FFmpeg multimedia library. This is due to incorrect memory deallocation before removing the last reference...

PT-2019-6246

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.2 Description A Denial of Service issue exists due to a memory leak in the ff frame pool get function in framepool.c. This is caused by incorrect memory release before removing the last reference. Exploitation of this issue...

PT-2019-14570

Name of the Vulnerable Software and Affected Versions ArcGIS Enterprise version 10.6.1 Description A crafted IFRAME element can be used to trigger a Cross Frame Scripting XFS attack through the EDIT MY PROFILE feature. Recommendations For ArcGIS Enterprise version 10.6.1, consider disabling the...

CVE-2019-16193: Improper Neutralization of Input During Web Page Generation

In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting XFS attack through the EDIT MY PROFILE feature...

PT-2021-10719

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.2 Description A Denial of Service issue exists due to a memory leak in the v frame alloc function in frame.c. Recommendations For FFmpeg version 4.2, update to a version that fixes the memory leak in the v frame alloc function...

PT-2019-6242

Name of the Vulnerable Software and Affected Versions FFmpeg version 4.2 Description A Denial of Service issue exists due to a memory leak in the av buffersrc add frame flags function in buffersrc. This is caused by incorrect memory release before removing the last reference, allowing a remote...

CVE-2019-11464: Improper Neutralization of Input During Web Page Generation

Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and...

Palo Alto Software: Clickjacking

Summary Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of the...

PT-2019-12876

Name of the Vulnerable Software and Affected Versions Espressif ESP-IDF versions 2.0.0 through 4.0.0 Espressif ESP8266 NONOS SDK versions 2.2.0 through 3.1.0 Description The issue concerns the EAP peer implementation, allowing the installation of a zero Pairwise Master Key PMK after completing an...

SUSE-SU-2019:2262-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-1125: Enable Spectre v1 swapgs mitigations bsc1139358. - CVE-2018-20855: An issue was discovered in createqpcommon in drivers/infiniband/hw/mlx5/qp.c,...

SUSE-SU-2019:2259-1 Security update for nodejs10

This update for nodejs10 to version 10.16.3 fixes the following issues: Security issues fixed: - CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service bsc1146091. -...

CVE-2019-3639

Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway MWG 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header...