Medium: libxslt

Issue Overview: libxslt allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded. CVE-2019-11068 Affected...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4710)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4710 advisory. - fork: record starttime late David Herrmann Orabug: 29850581 CVE-2019-6133 - x86/retpoline/ia32entry: Convert to non-speculative calls Ankur Arora...

Design/Logic Flaw

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled webaccessibleresources. Mailvelope implements additional measures to preve...

Cross-site Request Forgery (CSRF)

apache solr is vulnerable to cross-site request forgery CSRF. A remote attacker with access to the server could perform HTTP GET requests to any reachable URL on behalf of the user. This is due to the shards parameter not having a corresponding whitelist mechanism, disallowing the server to...

The vulnerability of the installation mechanism for the software development tools for Intel Data Center Manager SDK allows a perpetrator to disclose protected information due to security flaws in the mechanism.

The vulnerability of the mechanism for installing the software set for developing Intel Data Center Manager SDK is related to security flaws in this mechanism. Exploiting this vulnerability could allow attackers to disclose sensitive information that is protected by this system...

The vulnerability of the installation mechanism for the software set for developing Intel Data Center Manager SDK allows unauthorized access, enabling attackers to enhance their privileges.

The vulnerability of the installation mechanism for the software development tools for Intel Data Center Manager SDK is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to enhance their privileges...

The vulnerability of the installation program for the OpenVINO toolset for Linux operating systems allows a hacker to disclose protected information.

The vulnerability of the installation program for the OpenVINO application development suite on Linux operating systems is related to security mechanism errors. Exploiting this vulnerability can allow attackers to disclose sensitive information that is protected by these mechanisms...

17-Year-Old Weakness in Firefox Let HTML File Steal Other Files From Device

Except for phishing and scams, downloading an HTML attachment and opening it locally on your browser was never considered as a severe threat until a security researcher today demonstrated a technique that could allow attackers to steal files stored on a victim's computer. Barak Tawily, an...

KLA12055 ACE vulnerability in Cisco Jabber

A loading mechanism vulnerability was found in Cisco Jabber. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories Cisco Jabber for Windows DLL Preloading Vulnerability Related products Cisco-Jabber CVE list CVE-2019-1855 high Solution Update to the latest...

Cross site scripting

An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to...

SUSE SLED15 / SLES15 Security Update : libxslt (SUSE-SU-2019:1221-2)

This update for libxslt fixes the following issues : Security issue fixed : CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead and xsltCheckWrite would permit access upon receiving an error bsc1132160. Note that Tenable Network Security has extracted the preceding...

SUSE-SU-2019:1221-2 Security update for libxslt

This update for libxslt fixes the following issues: Security issue fixed: - CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead and xsltCheckWrite would permit access upon receiving an error bsc1132160...

Protection Mechanism Bypass

MantisBT is vulnerable to protection mechanism bypass. It leads to the bypass of CAPTCHA protection mechanism since the publickey parameter value is treated as the key to the CAPTCHA answer, demonstrating the attack via entering the publickey value 0 for E4652...

Account Takeover Vulnerability Found in Popular EA Games Origin Platform

A popular gaming platform used by hundreds of millions of people worldwide has been found vulnerable to multiple security flaws that could have allowed remote hackers to takeover players' accounts and steal sensitive data. The vulnerabilities in question reside in the "Origin" digital distributio...

Ann Day honey network capture“use of the ElasticSearch Groovy vulnerability Monroe coin(Dog)mining”event analysis-vulnerability warning-the black bar safety net

1, Overview 2019 6 May 13, Ann Day honey network capture to use CVE-2015-1427ElasticSearch Groovyremote command execution vulnerability attacks. The vulnerability principle is Elaticsearch groovy as a scripting language, and based on the use of black and white lists of the sandbox mechanism to...

Chakra vulnerability debugging notes 1--ImplicitCall-vulnerability warning-the black bar safety net

Chakra is Microsoft's next-generation browser, Microsoft Edge the Javascript parsing engine, 继承自IE浏览器的jscript9.dll and on GitHub open source for ChakraCore it. Chakra since open source has become a Windows platform vulnerability discovery one of the main goals, is also everyone to learn binary...

CVE-2019-10226

HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is a XSS protection...

Design/Logic Flaw

An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between t...

CVE-2018-10694

An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between t...

CVE-2018-10690

The CVE-2018-10690 entry concerns Moxa AWK-3121 (version 1.14) where the device defaults to HTTP, enabling cleartext transmission of sensitive information. Multiple connected sources confirm the vulnerability is due to insecure web traffic allowing an attacker to sniff credentials and other data....