DEBIAN-CVE-2019-15691

TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack...

UBUNTU-CVE-2019-15693

TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity...

Amazon Linux 2 : thunderbird (ALAS-2019-1376)

Several memory safety bugs were discovered in Mozilla Firefox and Thunderbird. Memory corruption and arbitrary code execution are possible with these vulnerabilities. These bugs can be exploited over the network.CVE-2019-11764 A flaw was discovered in both Firefox and Thunderbird where 4 bytes of...

Important: thunderbird

Issue Overview: Several memory safety bugs were discovered in Mozilla Firefox and Thunderbird. Memory corruption and arbitrary code execution are possible with these vulnerabilities. These bugs can be exploited over the network.CVE-2019-11764 A flaw was discovered in both Firefox and Thunderbird...

Siemens Mentor Nucleus Networking Module

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: Mentor Nucleus Networking Module Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to affect the integrity and...

ALPINE-CVE-2019-15681

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak CWE-655 in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. Thi...

DEBIAN-CVE-2019-15679

TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable via network connectivity...

Mozilla: Potentially exploitable crash due to 360 Total Security

A flaw was found in the 360 Total Security code in Firefox and Thunderbird. Memory corruption is possible in the accessibility engine that could lead to an exploit to run arbitrary code. This vulnerability could be exploited over a network connection and would affect confidentiality and integrity...

CVE-2019-11761

A vulnerability was found in Mozilla Firefox and Thunderbird. Privileged JSONView objects that have been cloned into content can be accessed using a form with a data URI. This flaw bypasses existing defense-in-depth mechanisms and can be exploited over the network...

CVE-2019-2778

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

SUSE-SU-2019:1671-1 Security update for the Linux Kernel (Live Patch 27 for SLE 12 SP2)

This update for the Linux Kernel 4.4.121-92101 fixes several issues. The following security issues were fixed: - CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless networ...

Siemens LOGO!8 Buffer Overflow Vulnerability

LOGO!8 is the 8th generation of Siemens intelligent logic controllers, the Nano PLC in the Siemens PLC family, which simplifies programming configurations, has an integrated panel for more displays, and can be easily networked and efficiently interconnected via the integrated Ethernet interface. ...

Microsoft Windows Jet Database Engine Buffer Overflow Vulnerability (CNVD-2019-24836)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Windows Jet Database Engine is one of the database engines. A buffer overflow vulnerabilit...

ImageWorsener Resource Management Error Vulnerability

ImageWorsener is a set of image scaling and processing utilities. A resource management error vulnerability exists in the 'iwgifinitscreen' function of the imagew-gif.c file in ImageWorsener version 1.3.2. The vulnerability stems from mismanagement of system resources e.g., memory, disk space,...

FreeBSD : MySQL -- multiple vulnerabilities (4e1997e8-5de0-11e9-b95c-b499baebfeaf)

Oracle reports : Critical Patch Update Oracle MySQL Executive Summary This Critical Patch Update contains 44 new security fixes for Oracle MySQL. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials...

UltraVNC out-of-bounds access vulnerability (CNVD-2019-10287)

UltraVNC is an open source remote terminal control software for the Windows platform. A security vulnerability exists in UltraVNC version 1207. An attacker can exploit the vulnerability to execute code over a network connection...

CVE-2019-8263

UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denial of service DoS condition. This attack appear to be exploitable via network connectivity. User interaction is required to trigger this vulnerability. This...

CVE-2019-1000006

RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sockdns, an implementation of the DNS protocol utilizing the RIOT sock API that can result in Remote code executing. This attack appears to be exploitable via network connectivit...

CVE-2019-2546

Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite subcomponent: SQL Extensions. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker...

Lenovo R2105 - Cross-Site Request Forgery (Command Execution)

Exploit Title: Lenovo R2105 Remote Code Execution through CSRF Date: 01/14/2019 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Version: 1.0 Tested on: Windows 10 x64 Note: The administrator who opens the URL should be authenticated. import socket serverip = "0.0.0.0" serverport = 80...