Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Firefox regression (USN-3918-3)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3918-3 advisory. USN-3918-1 fixed vulnerabilities in Firefox. The update caused web compatibility issues with some websites. This update fixes the problem...

Design/Logic Flaw

The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files related to libpicsel, which allows MITM attacks...

CVE-2019-10251

The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files related to libpicsel, which allows MITM attacks...

Design/Logic Flaw

UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks...

CVE-2019-10250

UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks...

CVE-2019-10251

The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files related to libpicsel, which allows MITM attacks...

CVE-2019-10251

The CVE-2019-10251 entry concerns the UCWeb UC Browser on Android (pre-2020) that downloads modules tied to PDF/Office processing via libpicsel over HTTP. This insecure HTTP traffic enables man‑in‑the‑middle attacks against module downloads, exposing users to potential data interception or tamper...

CVE-2019-10250

UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks...

CVE-2019-1757

A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected...

Ubuntu: Security Advisory (USN-3918-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Hostname Verification For TLS

github.com/hashicorp/consul is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as it fails to perform hostname verification for agent-to-agent TLS communication, allowing MitM attacks...

Insecure UC Browser 'Feature' Lets Hackers Hijack Android Phones Remotely

Beware! If you are using UC Browser on your smartphones, you should consider uninstalling it immediately. Why? Because the China-made UC Browser contains a "questionable" ability that could be exploited by remote attackers to automatically download and execute code on your Android devices...

Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-3918-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3918-2 advisory. USN-3918-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Ubuntu 14.04 LTS. Tenable has extracted the preceding...

USN-3918-2: Firefox vulnerabilities

USN-3918-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Ubuntu 14.04 LTS. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit...

USN-3918-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, denial of service via successive FTP authorization prompts or modal alerts, trick...

Remote command injection through an endpoint security product

TL;DR? We discovered command injection in a popular endpoint security product, Heimdal Thor. By using the product, customers PCs were exposed to compromise. Irony++ Heimdal fixed the issue quickly and responded well, but it appears that the vulnerability had been present in 650,000 PCs for around...

Razer US: Razer Synapse 3 Chromasdk.io Root CA with Private Key Re-use

The researcher found that a root certificate was preinstalled with the Chroma SDK with a exposed private key. He assisted us in testing a fix. This was integrated into the codebase in May and published at the end of June. We appreciate his assistance working with us on this issue. Razer Synapse 3...

CVE-2019-9843

DiffPlug Spotless is affected by an XML External Entity (XXE) issue in the library and Maven plugin prior to 1.20.0 and in the Gradle plugin prior to 3.20.0. The XML parser resolves external entities over HTTP/HTTPS and ignores resolveExternalEntities, enabling potential disclosure of local files...

PortSwigger Web Security: Build fetches jars over HTTP

CWE-829: Inclusion of Functionality from Untrusted Control Sphere CWE-494: Download of Code Without Integrity Check PortSwigger maintains several Open Source Projects under the PortSwigger GitHub organization. Some of these projects contain build files that indicate that some of these projects ar...

X (Formerly Twitter): [Twitter Open Source] Releases were & are built/executed/tested/released in the context of insecure/untrusted code

Summary: CWE-829: Inclusion of Functionality from Untrusted Control Sphere CWE-494: Download of Code Without Integrity Check Twitter maintains several Open Source Projects under the Twitter GitHub organization. These projects contain build files that indicate that some of these projects are...