214 matches found
CVE-2019-1478
An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Privilege Vulnerability'...
KB4530692: Windows 7 and Windows Server 2008 R2 December 2019 Security Update
The remote Windows host is missing security update 4530692 or cumulative update 4530734. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input. An attacker could exploit the...
Microsoft Windows Multiple Vulnerabilities (KB4525237)
This host is missing a critical security update according to Microsoft KB4525237 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...
Microsoft Windows Multiple Vulnerabilities (KB4523205)
This host is missing a critical security update according to Microsoft KB4523205 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...
CVE-2019-1405
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play UPnP service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'...
CVE-2019-1405
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play UPnP service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'...
PT-2019-3921
Name of the Vulnerable Software and Affected Versions Microsoft Windows Universal Plug and Play UPnP Service affected versions not specified Description An elevation of privilege issue exists due to the improper allowance of COM object creation by the Windows Universal Plug and Play UPnP service...
Ruby: Variant of CVE-2013-0269 (Denial of Service and Unsafe Object Creation Vulnerability in JSON)
During my recent keyword argument separation work on rbscanargs in the master branch, I discovered what I now think is a vulnerability. While the CVE-2013-0269 change fixed most usage of JSON.parse, it ended up not fixing KernelJSON. The reason behind this is that internally, in...
wildfly-core: Cross-site scripting (XSS) in JBoss Management Console
A cross-site scripting XSS vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users...
CVE-2018-10934
A cross-site scripting XSS vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users...
Authentication flaw
gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILEDEVICESECUREOPEN and therefore files and directories "inside" the \.\gdwfpcd device are not properly protected, leading to unintended impersonation or...
wildfly-core: Cross-site scripting (XSS) in JBoss Management Console
A cross-site scripting XSS vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users...
Scripting Engine Information Disclosure Vulnerability
An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user’s computer or data. To exploit the vulnerability, an attacker must know the memory address of where the objec...
Design/Logic Flaw
EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILEDEVICESECUREOPEN and therefore files and directories "inside" the \.\EPP device are not properly protected, leading to unintended impersonation or objec...
CVE-2019-7651
EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILEDEVICESECUREOPEN and therefore files and directories "inside" the \.\EPP device are not properly protected, leading to unintended impersonation or objec...
CVE-2019-7651
EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILEDEVICESECUREOPEN and therefore files and directories "inside" the \.\EPP device are not properly protected, leading to unintended impersonation or objec...
Microsoft JScript Security Feature Bypass Vulnerability
A security feature bypass vulnerability exists in Microsoft JScript that could allow an attacker to bypass Device Guard. To exploit the vulnerability, an attacker would first have to access the local machine, and run a specially crafted application to create arbitrary COM objects. The update...
CVE-2018-10934
A cross-site scripting XSS vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users...
Unspecified Vulnerability in Math.js
Math.js is a math library for JavaScript and Node.js that supports symbolic computation with a large number of built-in functions and constants. A security vulnerability exists in Math.js versions prior to 3.17.0. The vulnerability can be exploited by an attacker to replace private properties whe...
Unauthorized Constructor Replacement
mathjs is vulnerable to unauthorized constructor replacement. The vulnerability is possible because restricted properties like constructor functions can be replaced by unicode characters when creating an object. This can lead to arbitrary code execution attack through the constructor...