11005 matches found
PT-2019-6081
Name of the Vulnerable Software and Affected Versions Citrix Workspace App versions prior to 1904 for Windows Citrix Receiver for Windows affected versions not specified Description The issue is related to incorrect access control in the Citrix Workspace App, which can be exploited by a remote...
CVE-2019-6548
GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, which may allow control over the database. This service is inaccessible to attackers if Windows default firewall settings are used by the end user...
CVE-2019-11820
Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline...
PT-2019-18166 · Ge · Ge Communicator
Name of the Vulnerable Software and Affected Versions: GE Communicator versions prior to 4.0.517 Description: The issue allows a non-administrative user to place malicious files within the installer file directory. This may enable an attacker to gain administrative privileges on a system during...
chromium-browser: Use after free in Blink
Use after free in file chooser in Google Chrome prior to 74.0.3729.108 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page...
chromium-browser: Memory corruption in V8
Object lifetime issue in V8 in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
ALPINE-CVE-2018-12404
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack and affects all NSS versions prior to NSS 3.41...
openstack-cinder: Data retained after deletion of a ScaleIO volume
An information-leak flaw was found in openstack-cinder deployments using the third-party EMC ScaleIO backend. It was possible for new volumes to contain previous data if they were created from storage pools which had disabled zero-padding. An attacker could exploit this flaw to obtain sensitive...
Apache Archiva Input Validation Error Vulnerability (CNVD-2019-26509)
Apache Archiva is a suite of software from the Apache USA Software Foundation for managing one or more remote repositories. The software provides features such as remote Repository agents, role-based secure access management, and usage reporting. An input validation error vulnerability in Apache...
PT-2019-19383 · Daview · Daviewindy
Name of the Vulnerable Software and Affected Versions: DaviewIndy versions 8.98.7 and earlier Description: The issue is triggered when a user opens a malformed PDF file that is mishandled by Daview.exe, leading to an integer overflow. This could allow attackers to exploit the issue and achieve...
CVE-2018-7577
Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory...
MAAS Cross-Site Scripting Vulnerability
Canonical Ubuntu Metal as a Service MAAS is a suite of cloud server deployment and management tools from Canonical in the UK. The tool enables centralized deployment and management of a large number of server hardware environments. A cross-site scripting vulnerability exists in the REST API in...
CVE-2019-2723
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
UBUNTU-CVE-2019-2678
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
UBUNTU-CVE-2019-2721
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
UBUNTU-CVE-2019-2696
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
CVE-2019-2587
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Partition. Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...
CVE-2019-2592
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: PS. Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...
DEBIAN-CVE-2019-3901
A race condition in perfeventopen allows local attackers to leak sensitive data from setuid programs. As no relevant locks in particular the credguardmutex are held during the ptracemayaccess call, it is possible for the specified target task to perform an execve syscall with setuid execution...