CVE-2019-10884: Improper Authentication

Uniqkey Password Manager 1.14 contains a vulnerability because it fails to recognize the difference between domains and sub-domains. The vulnerability means that passwords saved for example.com will be recommended for usersite.example.com. This could lead to successful phishing campaigns and crea...

CVE-2014-3603: Improper Validation of Certificate with Host Mismatch

The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2019:0789-1)

This update for ntp fixes the following issues : Security issue fixed : CVE-2019-8936: Fixed a NULL pointer exception which could allow an authenticated attcker to cause segmentation fault to ntpd bsc1128525. Other isses addressed: Fixed an issue which caused openSSL mismatch bsc1125401 Fixed...

SUSE-SU-2019:0789-1 Security update for ntp

This update for ntp fixes the following issues: Security issue fixed: - CVE-2019-8936: Fixed a null pointer exception which could allow an authenticated attcker to cause segmentation fault to ntpd bsc1128525. Other isses addressed: - Fixed an issue which caused openSSL mismatch bsc1125401 - Fixed...

GHSA-GF2V-9HP6-44QG org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service vulnerable to Improper Certificate Validation

Apache Hive JDBC + HiveServer2 implements SSL for plain TCP and HTTP connections it supports both transport modes. While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name...

Windows Kernel Logic Bug Class: Access Mode Mismatch in IO Manager

Posted by James Forshaw, Project Zero This blog post is an in-depth look at an interesting logic bug class in the Windows Kernel and what I did to try to get it fixed with our partners at Microsoft. The maximum impact of the bug class is local privilege escalation if kernel and driver developers...

Endpoint Management 10.9.0.12 - Profile installation failed, MDM Payroll error

Unable to enroll DEP devices, failing while the 2nd profile installation with an error: "the new mdm payload doesn't match the old payload"...

CVE-2018-18503

When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatch in some situations. This vulnerability affects Firefox 65...

CVE-2018-18503: Improper Restriction of Operations within the Bounds of a Memory Buffer

When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatch in some situations. This vulnerability affects Firefox 65...

SSL/TLS Certificate Common Name Mismatch

The remote server presents a SSL/TLS certificate for which the Common Name and the Subject Alternative Name don't match the server's hostname. No source data...

Mozilla Firefox < 65.0

The version of Firefox installed on the remote Windows host is prior to 65.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-01 advisory. - Mozilla developers and community members Arthur Iakab, Christoph Diehl, Christian Holler, Kalel, Emilio Cobos lvarez,...

UBUNTU-CVE-2018-18503

When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatch in some situations. This vulnerability affects Firefox 65...

PT-2019-1341

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 65 Description The issue is related to a compartment mismatch that may occur when JavaScript is used to create and manipulate an audio buffer, potentially leading to a crash. It is also associated with resource releas...

The vulnerability of the pcwin.dll library in temperature control software, related to a data type mismatch error, allows a hacker to execute code remotely.

The vulnerability of the pcwin.dll library in the GUI temperature control software is related to a data type mismatch error. Exploiting this vulnerability could allow an attacker to execute arbitrary code during the syntactic analysis of the GD1 file...

The vulnerability of the 3core.dll software for temperature control, specifically GUIcon, arises from a type mismatch error in the used data types. This allows an attacker to execute arbitrary code.

The vulnerability of the 3core.dll software for temperature control, related to the GUIcon component, is due to a type mismatch error in the used data types. Exploiting this vulnerability allows an attacker to execute code during the syntactic analysis of the GD1 file...

DEBIAN-CVE-2018-20452

The readMSATbody function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted file, because of inconsistent memory management new versus free in ole2readheader in ole.c...

PT-2018-15602 · Pulseaudio · Libpulse

Name of the Vulnerable Software and Affected Versions: libpulse-binding versions prior to 2.5.0 Description: The issue is related to a use-after-free problem with property list iteration due to a lack of a lifetime constraint tying the lifetime of a proplist::Iterator to the Proplist object for...

DEBIAN-CVE-2018-19876

cairo 1.16.0, in cairoftapplyvariations in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a "free: invalid pointer" error...

PT-2018-15134

Name of the Vulnerable Software and Affected Versions cairo version 1.16.0 Description The issue occurs in the cairo ft apply variations function, located in cairo-ft-font.c, where memory is freed using a function incompatible with WebKit's fastMalloc, resulting in an application crash with a...

undertow: Client can use bogus uri in Digest authentication

It was discovered that when using Digest authentication, the server does not ensure that the value of the URI in the authorization header matches the URI in the HTTP request line. This allows the attacker to execute a MITM attack and access the desired content on the server...