6662 matches found
SUSE-SU-2019:2046-1 Security update for ardana packages
This update for ardana package fixes the following issues: - Update to version 9.0+git.1560211997.7ac9792: Adds repository list parameter bsc1122825 - Update to version 9.0+git.1557219331.457b6e7: Update gerrit location SCRD-9140 - Switch to new Gerrit Server - Update to version...
CVE-2019-14521
The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter...
Valve: [steam client] Opening a specific steam:// url overwrites files at an arbitrary location
If a user opens steam://devkit-1/list-shortcuts?response=/tmp/testfile, a file /tmp/testfile will be created containing the response to this request. Another problem with this is that the file will be overwritten if it already exists. The owner of the file will be the same as the user that runs t...
CVE-2017-18383
cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...
CVE-2017-18383
cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...
Design/Logic Flaw
cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...
CVE-2017-18383
cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...
Google Chrome Security Bypass Vulnerability (CNVD-2019-26519)
Google Chrome is a web browser from Google, an American company. A security vulnerability exists in versions of Google Chrome prior to 76.0.3809.87, which stems from the program's failure to perform a check on the location of a click. An attacker could exploit the vulnerability by tricking a user...
CVE-2019-5401
A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. The attack exploits an xss injection by setting the attack vector in one of the switch persistent configuration fields management URL, location, contact. But admin privileges are required to configure the...
Mobile Menace Monday: Dark Android Q rises
Android Q, the upcoming 10th major release of the Android mobile operating system, was developed by Google with three major themes in mind: innovation, security, and privacy. Today, we are going to focus mostly on security and privacy, although there are still many potential changes and updates o...
Streamlining Patch Management: Expert Advice
Patch management has been a song of constant sorrows for system administrator. There have been improvements. But still, 80 percent of enterprise systems feature unpatched CVE vulnerabilities, according CA Veracode’s State of Software Security. The good news is, software patching has gotten better...
The App Creeping on Your IG Location, Jakarta’s Insurance Crisis, and More News
Catch up on the most important news from today in two minutes or less...
On TikTok, Teens Meme Life360, the Safety App Ruining Their Summer
Parents can use Life360 to track their teen’s location in real time. The company can use that data to sell car insurance...
Bug in Anesthesia Respirators Allows Cyber-Tampering
A vulnerability in GE Healthcare’s Aestiva and Aespire anesthesia devices would allow an unauthenticated cybercriminal on the same network as the device to modify gas composition parameters within the devices’ respirator function, thus changing sensor readings for gas density. According to GE...
CVE-2019-1855
A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform a DLL preloading attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The...
Race condition
deepin-clone before 1.1.3 uses a predictable path /tmp/.deepin-clone/mount/ in the Helper::temporaryMountDevice function to temporarily mount a file system as root. An unprivileged user can prepare a symlink at this location to have the file system mounted in an arbitrary location. By winning a...
The Simple Way Apple and Google Let Domestic Abusers Stalk Victims
To prove a point about common location-sharing apps, I asked my wife to use them to spy on me...
Dating App Jack'd Fined After Leaking Users' Nude Pics
LGBTQ dating app Jack’d must cough up a $240,000 fine and “make substantial changes to improve security” on the heels of a security faux pas that leaked the private data – including nude photos – of thousands of its users. Jack’d is a popular location-based app that caters to gay and bisexual men...
Exiv2 Input Validation Error Vulnerability
Exiv2 is a set of C++ libraries and command line applications for managing image metadata by Andreas Huggel programmers. The product provides the ability to read and write image metadata in a variety of formats including EXIF, IPTC and XMP. An input validation error vulnerability exists in Exiv2...