CVE-2019-18663

CVE-2019-18663 affects ARP-GUARD 4.0.0-5. The connected CNVD/NVD records describe a SQL injection vulnerability in the /login/forgot1 POST endpoint, exploitable by an unauthenticated remote attacker to execute arbitrary SQL via the user_id parameter. Root cause is lack of input validation/paramet...

Further enhancing security from Microsoft, not just for Microsoft

Legacy infrastructure. Bolted-on security solutions. Application sprawl. Multi-cloud environments. Company data stored across devices and apps. IT and security resource constraints. Uncertainty of where and when the next attack or leak will come, including from the inside. These are just a few of...

CVE-2019-18663: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the userid parameter...

PT-2019-15564

Name of the Vulnerable Software and Affected Versions ARP-GUARD version 4.0.0-5 Description A SQL injection issue allows unauthenticated remote attackers to execute arbitrary SQL commands. This is achieved via the user id parameter in a "/login/forgot1" POST request. Recommendations For ARP-GUARD...

Incorrect Authentication Leading To Impersonation

Search Guard Kibana Plugin is susceptible to incorrect authentication. It is possible for a Kibana user to impersonate as kibanaserver user by submitting incorrect credentials and by fulfilling following conditions: 1 Kibana is configured to use Single-Sign-On as authentication method, one of...

Microsoft and partners design new device security requirements to protect against targeted firmware attacks

Recent developments in security research and real-world attacks demonstrate that as more protections are proactively built into the OS and in connected services, attackers are looking for other avenues of exploitation with firmware emerging as a top target. In the last three years alone, NIST’s...

Servicing stack update for Windows 10 version 1709: October 8, 2019

None None...

Servicing stack update for Windows 10 version 1903: October 8, 2019

None None...

CVE-2019-13419

Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked...

CVE-2019-13420

Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...

CVE-2019-2294

Usage of hard-coded magic number for calculating heap guard bytes can allow users to corrupt heap blocks without heap algorithm knowledge in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial...

CVE-2019-2294

Usage of hard-coded magic number for calculating heap guard bytes can allow users to corrupt heap blocks without heap algorithm knowledge in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial...

Servicing stack update for Windows Server 2012: October 8, 2019

Servicing stack update for Windows Server 2012: October 8, 2019 Summary This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Key changes include the following: Improves the Secure Boot revocation list DBX update experience to avoid...

CVE-2019-2294: Use of Insufficiently Random Values

Usage of hard-coded magic number for calculating heap guard bytes can allow users to corrupt heap blocks without heap algorithm knowledge in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial...

A week in security (September 16 -22)

Last week on Labs, we sounded the alarm about the relaunch of Emotet, one of the year's most dangerous forms of malware, with a new spam campaign. We also reported on how international students in UK are targeted by visa scammers, what CEOs think about a potential US data privacy law, and...

Browser Guard combats privacy abuse, tracking, clickbait, and scammers

In July 2018, we introduced the Malwarebytes Browser Extension, a beta plugin for Firefox and Chrome aimed at delivering a safer, faster, and more private browsing experience. Our extension blocked tech support scams, hijackers, pop-up ads, trackers, and more to keep users secure and free from...

[SECURITY] Fedora 29 Update: libgcrypt-1.8.5-1.fc29

Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...

[SECURITY] Fedora 31 Update: libgcrypt-1.8.5-1.fc31

Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...

floragunn Search Guard Information Disclosure Vulnerability (CNVD-2019-32495)

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . An information disclosure vulnerability exists in versions prior to floragunn Sear...

floragunn Search Guard Authorization Issue Vulnerability (CNVD-2019-32491)

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . An authorization issue vulnerability exists in versions prior to floragunn Search...