EulerOS Virtualization for ARM 64 3.0.2.0 : zip (EulerOS-SA-2019-1925)

According to the version of the zip package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - DISPUTED Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service...

EulerOS 2.0 SP2 : zip (EulerOS-SA-2019-1876)

According to the version of the zip package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service invalid free and application crash o...

CVE-2019-16321

ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATHINFO...

CVE-2019-16320

Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude, via the public SNMP community...

CVE-2019-16311

NIUSHOP V1.11 has CSRF via searchinfo to index.php...

Cross site request forgery (csrf)

NIUSHOP V1.11 has CSRF via searchinfo to index.php...

Security update for rdesktop (important)

openSUSE Security Update: Security update for rdesktop Announcement ID: openSUSE-SU-2019:2135-1 Rating: important References: 1121448 Cross-References: CVE-2018-20174 CVE-2018-20175 CVE-2018-20176 CVE-2018-20177 CVE-2018-20178 CVE-2018-20179 CVE-2018-20180 CVE-2018-20181 CVE-2018-20182...

Node.js third-party modules: [expressjs-ip-control] Whitelist IP bypass leads to authorization bypass and sensitive info disclosure

I would like to report a unauthenticated access/authorization bypass issue in the expressjs-ip-control module. It allows to bypass the whitelist IP check in order to bypass the authorization check and possibly expose sensitive datas. Module module name: MODULE NAME version: MODULE VERSION npm pag...

jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution

A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

CVE-2019-11549

CVE-2019-11549 describes an information disclosure in GitLab’s Gitaly component. The affected products are GitLab Community Edition and Enterprise Edition versions 9.x, 10.x, and 11.x with specific pre-release thresholds: 11.8.9 for 9.x/10.x, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. The...

PT-2019-14504 · Symonics +2 · Libmysofa +2

Name of the Vulnerable Software and Affected Versions: Symonics libmysofa version 0.7 Description: The issue is related to an invalid read in the getDimension function located in hrtf/reader.c. This problem can lead to unintended behavior. Recommendations: For Symonics libmysofa version 0.7,...

CVE-2019-9461

In the Android kernel in VPN routing there is a possible information disclosure. This could lead to remote information disclosure by an adjacent network attacker with no additional execution privileges needed. User interaction is not needed for exploitation...

DEBIAN-CVE-2019-9444

In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation...

CVE-2019-9455

CVE-2019-9455: In the Android kernel video driver, there is a kernel pointer leak caused by a WARN_ON statement, leading to local information disclosure with System execution privileges needed. Local exploitation is possible without user interaction. The connected Nessus advisories corroborate th...

CVE-2019-9245

CVE-2019-9245 details (supported by connected docs): In the Android kernel, the f2fs driver contains a missing bounds check leading to a possible out-of-bounds read. This can cause local information disclosure and requires System privileges for exploitation, with no user interaction needed. The N...

CVE-2019-5065

Blynk-Library v0.6.1 contains an information-disclosure vulnerability in the packet-parsing path (BlynkProtocol::processInput). Specifically, in the BLYNK_CMD_REDIRECT handling, the code allocates 32 bytes for redir_serv and copies exactly 32 bytes via strncpy, which can result in a non-null-term...

The vulnerabilities in the sound/core/init.c and sound/core/info.c components of the Linux operating system’s kernel allow a hacker to trigger a service failure.

The vulnerability in the sound/core/init.c and sound/core/info.c components of the Linux kernel is related to the use of memory after it has been freed. Exploiting this vulnerability could allow an attacker to cause a system failure...

BRATA Android RAT Steals Banking Info in Real Time

A powerful Android remote access tool RAT family dubbed BRATA is proliferating, with at least 20 different variants cropping up since it was first spotted in January. The majority of the binaries have been found in the official Google Play store, masquerading as updates for the instant messaging...

CVE-2019-1125

CVE-2019-1125 is a Linux kernel local information-disclosure vulnerability related to SWAPGS speculation (Spectre variant 1). The issue allows a local attacker to read kernel/privileged memory through speculative execution on most x86 processors; mitigation relies on memory barriers to limit spec...

Malicious Package

Overview This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise. References GitHub Advisory...