CVE-2019-8124

Magento 2.x contains an insufficient logging and monitoring vulnerability (CVE-2019-8124) where admin actions related to design configuration are not tracked, enabling repudiation risks. Affected versions: Magento 2.1 before 2.1.19, Magento 2.2 before 2.2.10, and Magento 2.3 before 2.3.3. Remedia...

CVE-2019-8123

CVE-2019-8123 affects Magento products across multiple lines: Magento 1.x (before 1.9.4.3 and 1.14.4.3) and Magento 2.x (2.1 before 2.1.19, 2.2 before 2.2.10, 2.3 before 2.3.3). The issue is an insufficient logging and monitoring vulnerability where the logging feature lacks enough data to effect...

CVE-2019-8123

An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. The logging feature required for effective monitoring did not contain sufficent data to effectively track...

Moderate: Red Hat Security Advisory: libqb security and bug fix update

An update for libqb is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2019-10084

In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization and audit mechanisms. Session and query IDs are unique an...

CVE-2019-10084

In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization and audit mechanisms. Session and query IDs are unique an...

Authorization

In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization and audit mechanisms. Session and query IDs are unique an...

CVE-2019-10084

CVE-2019-10084 affects Apache Impala 2.7.0 to 3.2.0. An authenticated user who can observe the IDs of active queries or sessions can craft requests to interact with those sessions/queries, potentially bypassing authorization and audit controls. Root causes noted include: session/query IDs are uni...

MGASA-2019-0309 Updated ansible packages fix security vulnerabilities

Updated ansible package fixes security vulnerabilities: ansible-playbook -k and ansible cli tools prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them CVE-2019-10206. Ansible was...

Huawei Honor 10 Lite, Honor 8A and Huawei Y6 Information Disclosure Vulnerability

The Huawei Honor 10 Lite, among others, is a smartphone from the Chinese company Huawei Huawei. An information disclosure vulnerability exists in Huawei Honor 10 Lite prior to version 9.1.0.217 C00E215R3P1, Honor 8A prior to version 9.1.0.205 C00E97R1P9, and Huawei Y6 prior to version 9.1.0.205...

[SECURITY] Fedora 29 Update: sudo-1.8.28-1.fc29

Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...

BSA-2019-865

Security Advisory ID : BSA-2019-865 Component : SANnav Revision : 1.0 The authentication mechanism, in Brocade SANnav versions before v2.0,logs plaintext account credentials at the ‘trace’ and the 'debug'logging level;which could allow a local authenticated attacker to access sensitive informatio...

U.N., UNICEF, Red Cross Under Ongoing Mobile Attack

An ongoing, mobile-focused phishing campaign is targeting the United Nations and several humanitarian aid organizations, including UNICEF, the Red Cross and UN World Food. The campaign is using landing pages signed by SSL certificates, to create legitimate-looking Microsoft Office 365 login pages...

ansible: secrets disclosed on logs when no_log enabled

Ansible was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process...

ansible: secrets disclosed on logs when no_log enabled

Ansible was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process...

ansible: secrets disclosed on logs when no_log enabled

Ansible was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process...

[SECURITY] Fedora 31 Update: sudo-1.8.28-1.fc31

Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...

Important: Red Hat Security Advisory: OpenShift Container Platform logging-elasticsearch5-container security update

An update for logging-elasticsearch5-container is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Exploit for Improper Handling of Exceptional Conditions in Sudo_Project Sudo

Sudo-Security-Bypass-CVE-2019-14287 ==========================...

Debian: Security Advisory (DLA-1964-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...