SUSE-SU-2018:2230-1 Security update for clamav

This update for clamav to version 0.100.1 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-0360: HWP integer overflow, infinite loop vulnerability bsc1101410 - CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small fil...

SUSE-SU-2018:2232-1 Security update for clamav

This update for clamav to version 0.100.1 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-0360: HWP integer overflow, infinite loop vulnerability bsc1101410 - CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small fil...

Unable to un-check the "Disable display scaling on high DPI settings" for Citrix Desktop Viewer

Citrix Desktop Viewer is unable to reach the correct resolution of a 4k monitor. Max resolution by the monitor is 3840 x 2160 but when launched Desktop Viewer is able to reach only 2560 x 1440. Changing the High DPI settings to use the native resolution Advanced High DPI, Select "No, use native...

How to disable TLS 1.0 with no impact on Veeam ONE functionality

Possible Veeam ONE issues with disabling TLS 1.0 protocol and their resolution plans...

Shipt: Price manipulation via fraction values (Parameter Tampering)

A security researcher identified an issue in our member application that showed how a user's cart would accept fractional quantities of any item; irrespective of whether or not the item was capable of being in a 'fractional' state e.g. fractional quantities were being accepted for a half pound of...

CVE-2018-14335: Improper Link Resolution Before File Access

An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files outside of their permissions via a symlink to a fake database file...

Design/Logic Flaw

The Apache TomEE console tomee-webapp has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this application included. This...

GHSA-4VCM-QFXH-P6C3 Directory Traversal in getcityapi.yoehoehne

Affected versions of getcityapi.yoehoehne resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable syste...

Jira - Insufficient Session Validation Web Vulnerability

Document Title: =============== Jira - Insufficient Session Validation Web Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1970 Video: https://www.youtube.com/watch?v=fCN5EaPiDrk Release Date: ============= 2018-07-22 Vulnerability Laboratory ID VL-ID:...

Apache Hadoop YARN ResourceManager remote command execution

Added: 07/20/2018 Background Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers. YARN Yet Another Resource Negotiator is the component of Apache Hadoop which manages resources. Problem A vulnerability in the REST API in the YARN...

CVE-2014-4150: Improper Link Resolution Before File Access

The scheme48-send-definition function in cmuscheme48.el in Scheme 48 allows local users to write to arbitrary files via a symlink attack on /tmp/s48lose.tmp...

CVE-2018-5532

On F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 a domain name cached within the DNS Cache of TMM may continue to be resolved by the cache even after the parent server revokes the record, if the DNS Cache is receiving a stream of requests for the cached name...

magput.ru XSS vulnerability

Open Bug Bounty ID: OBB-649328 Description| Value ---|--- Affected Website:| magput.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2018-15920 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite version 12.1.3 Description: The issue affects the Oracle Application Object Library component, specifically the Attachments / File Upload subcomponent. It allows an unauthenticated attacker with network access via HTTP...

tqdm: Arbitrary code execution

Background tqdm is a smart progress meter. Description A vulnerablility was discovered in tqdm.version that could allow a malicious git log within the current working directory. Impact A remote attacker could execute arbitrary commands by enticing a user to clone a crafted repo. Workaround There ...

HPSBHF03587 rev. 1 - Information Disclosure Vulnerability in Storage Media in Systems with Intel® Optane™ Memory Module with Whole Disk Encryption

Potential Security Impact Some platforms configured with Whole Disk Encryption and an Intel® Optane™ memory module, may be at risk of data remaining unencrypted and potentially accessible under specific conditions. Source: HP, HP Product Security Response Team PSRT Reported by: Intel VULNERABILIT...

Ebay Inc - CSRF Exploitation PoC of User Data Delete

Document Title: =============== Ebay Inc - CSRF Exploitation PoC of User Data Delete References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2053 Video: https://www.youtube.com/watch?v=KUenuqImsBs Release Date: ============= 2018-07-05 Vulnerability Laboratory ID VL-ID:...

Security Advisory 0035

Security Advisory 0035 . CSAF PDF Date: July 3, 2018 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | July 3, 2018 | Initial Release Arista CloudVision Portal Incorrect Permissions Vulnerability - CVE-2018-12357 CVSS v3: 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N This advisory is to document...

dns-sync Command Injection Vulnerability

dns-sync is a library used in Node.js that allows to resolve hostnames in a synchronized way. A security vulnerability exists in dns-sync. An attacker can exploit this vulnerability to inject commands with untrusted user input...

Chromium, Google Chrome: User-assisted execution of arbitrary code

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Description An out of bounds flaw has discovered in Chromium and Chrome’s ...