10668 matches found
CVE-2019-15514
The Privacy Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers...
Information disclosure
The Privacy Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers...
CVE-2019-15514
The CVE-2019-15514 entry concerns Telegram mobile app version 5.10 (Android/iOS) where the Privacy > Phone Number feature incorrectly indicates access level as Nobody. The vulnerability allows attackers to discover phone numbers via the Group Info feature, effectively causing information discl...
CVE-2019-15514
The Privacy Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers...
Important: pacemaker
Issue Overview: A flaw was found in pacemaker. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS. CVE-2018-16878 A use-after-free flaw was found in pacemaker which could result in certain sensitive information to be leaked via the system logs. CVE-2019-38...
CVE-2019-5041
An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words library, version 18.11.0.0. A specially crafted doc file can cause a stack-based buffer overflow, resulting in remote code execution. An attacker needs to provide a malformed file t...
CVE-2019-0173
Intel’s CVE-2019-0173 affects Intel RAID Web Console 2 (all versions). The problem is an authentication bypass in the web console that may allow an unauthenticated attacker to disclose information via network access. The advisory notes a remediation path: uninstall Intel RAID Web Console 2 and in...
UBUNTU-CVE-2019-15214
An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c...
CVE-2019-15135
The CVE-2019-15135 issue is in the handshake protocol of OMG DDS Security 1.1, which transmits cleartext information about a participant’s capabilities (including session-inapplicable ones). This leakage enables an attacker to discover potentially sensitive reachability information on a DDS netwo...
NSKeyedUnarchiver - Info Leak in Decoding SGBigUTF8String
NSKeyedUnarchiver - Info Leak in Decoding SGBigUTF8String There is an info leak when decoding the SGBigUTF8String class using SGBigUTF8String initWithCoder:. This class initializes the string using SGBigUTF8String initWithUTF8DataNullTerminated: even though there is no guarantee the bytes provide...
NSKeyedUnarchiver - Info Leak in Decoding SGBigUTF8String Exploit
There is an info leak when decoding the SGBigUTF8String class using SGBigUTF8String initWithCoder:. This class initializes the string using SGBigUTF8String initWithUTF8DataNullTerminated: even though there is no guarantee the bytes provided to the decoder are null terminated. It should use...
NSKeyedUnarchiver - Info Leak in Decoding SGBigUTF8String
There is an info leak when decoding the SGBigUTF8String class using SGBigUTF8String initWithCoder:. This class initializes the string using SGBigUTF8String initWithUTF8DataNullTerminated: even though there is no guarantee the bytes provided to the decoder are null terminated. It should use...
CVE-2019-0332
CVE-2019-0332 affects SAP BusinessObjects BI Platform (Info View), versions 4.1, 4.2, and 4.3. The vulnerability allows an attacker to supply a payload as a search keyword, which is executed during the search action, resulting in Cross-Site Scripting (XSS). Root cause: inadequate input handling i...
Osmedeus v1.5 - Fully Automated Offensive Security Framework For Reconnaissance And Vulnerability Scanning
Osmedeus allows you automated run the collection of awesome tools to reconnaissance and vulnerability scanning against the target. Installation git clone https://github.com/j3ssie/Osmedeus cd Osmedeus ./install.sh This install only focus on Kali linux, check more install on Wiki page How to use I...
[ASA-201908-8] postgresql: multiple issues
Arch Linux Security Advisory ASA-201908-8 ========================================= Severity: Medium Date : 2019-08-10 CVE-ID : CVE-2019-10208 CVE-2019-10209 Package : postgresql Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1019 Summary ======= The package...
Threat Roundup for August 2 to August 9
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 2 and Aug. 9. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
Information disclosure
Huawei smart phones Honor V20 with the versions before 9.0.1.161C00E161R2P2 have an information leak vulnerability. An attacker may trick a user into installing a malicious application. Due to coding error during layer information processing, attackers can exploit this vulnerability to obtain som...
Information Disclosure
keycloak-httpd-client-install is vulnerable to information disclosure. Users are able to submit passwords through command line, which would cause the passwords to be stored in command histories and process info...
Cross site scripting
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify product information...