Input validation

Insufficient input validation in the subsystem for IntelR AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable information disclosure via network access...

Security Bulletin: Vulnerability in OSPFv2 Routing Protocol Used in IBM i Operating System (CVE-2013-0149 and CVE-2013-5385)

Problem : The OSPFv2 routing protocol specified in RFC 2328 has an ambiguity that can be exploited and allow for traffic to be black-holed and/or redirected. A PTF is provided. Resolving The Problem VULNERABILITY DETAILS: DESCRIPTION: A potential protocol vulnerability has been identified in the...

Petwant PF-103 and Petalk AI Buffer Overflow Vulnerabilities

Petwant PF-103 is an automated pet feeder from Petwant Pet Products China.Petalk AI is an automated pet feeder with monitoring function. A buffer overflow vulnerability exists in the 'processCommandUploadSnapshot' function of the libcommon.so file in the Petwant PF-103 and Petalk AI version...

Siemens SSPPA-T3000 MS3000 Migration Server Out-of-Bounds Read Vulnerability (CNVD-2019-45371)

SPPA-T3000 is a distributed control system mainly used in thermal power plants and large-scale renewable energy power plants.MS3000 Migration Server is one of the migration servers. An out-of-bounds read vulnerability exists in the Siemens SSPPA-T3000 MS3000 Migration Server. An attacker with...

OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

MGASA-2019-0368 Updated libvncserver packages fix security vulnerability

Updated libvncserver packages fix security vulnerability: LibVNC contained a memory leak in VNC server code, which allowed an attacker to read stack memory and could be abused for information disclosure. Combined with another vulnerability, it could be used to leak stack memory and bypass ASLR...

Cesanta Mongoose Input Validation Error Vulnerability

Cesanta Mongoose is a set of embedded server libraries from the Irish company Cesanta, which includes features such as TCP, HTTP client and server, WenSocket client and server. An input validation error vulnerability exists in Cesanta Mongoose. The vulnerability stems from a network system or...

CVE-2019-18602

OpenAFS is affected by CVE-2019-18602: an information disclosure vulnerability caused by uninitialized scalars sent over the network to a peer. Affected series include OpenAFS before 1.6.24 and 1.8.x before 1.8.5. Debian security notices (DLA-1982-1) and OSV/NVD entries confirm the issue and prov...

CVE-2019-18602

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized scalars are sent over the network to a peer...

Ransomware, Mobile Malware Attacks to Surge in 2020

Cyber threats like targeted ransomware, mobile malware and sophisticated phishing attacks will escalate in 2020, researchers warn. However, defenses like artificial intelligence AI, cyber insurance and faster security response will also increase, helping defend companies against imminent threats,...

DEBIAN-CVE-2019-2973

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JAXP. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2019-2886

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware component: Services. The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks require hum...

CVE-2019-2970

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Filters. The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In...

CVE-2019-2977

Vulnerability in the Java SE product of Oracle Java SE component: Hotspot. Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of th...

CVE-2019-2933

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multipl...

OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

PT-2019-3520

Name of the Vulnerable Software and Affected Versions Android versions prior to the fixed version Description The issue is related to a use-after-free vulnerability in the Android kernel, specifically in the binder.c driver. This vulnerability allows an elevation of privilege from an application ...

Design/Logic Flaw

An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://███ (████████████████)

A path traversal vulnerability was discovered in Cisco VPN that could allow unauthenticated users to disclose sensitive information such as VPN sessions and files. The vulnerability was assigned CVE-2018-0296. The vulnerability was fixed in updated versions of the software...

OpenJDK: Missing URL format validation (Networking, 8221518)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access v...