PT-2019-15778

Name of the Vulnerable Software and Affected Versions Shibboleth Service Provider SP versions 3.x before 3.1.0 Description The issue allows a user to escalate to root by pointing symlinks to sensitive files, such as /etc/shadow, due to a spec file that calls chown on files in a directory controll...

The vulnerability of the Modbus protocol implementation in the “Communication Server” software of the EKRASMS-SP program suite for microprocessor-based EKRA 200 terminals allows a perpetrator to execute any command they desire.

The vulnerability of the Modbus protocol implementation in the “Communication Server” software of the EKRASMS-SP suite for microprocessor-based EKRA 200 terminals exists due to insufficient filtering of symbols in file paths. Exploiting this vulnerability allows a malicious actor to execute...

The vulnerability of the implementation of the interaction protocol between the “ARM Reliezer” software and the “Communication Server” software of the EKRASMS-SP software suite allows a perpetrator to exhaust the virtual memory available to it.

The vulnerability of the implementation of the interaction protocol between the “ARM Rielshchika” software and the “Server Connect” software of the EKRASMS-SP suite lies in the absence of restrictions on the size of the server list. Exploiting this vulnerability allows a malicious actor to exhaus...

SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2019:2957-1)

This update for ucode-intel fixes the following issues : Updated to 20191112 security release bsc1155988 - Processor Identifier Version Products - Model Stepping F-MO-S/PI Old-New - ---- new platforms ---------------------------------------- - CML-U62 A0 6-a6-0/80 000000c6 Core Gen10 Mobile - CNL...

PT-2019-14489

Name of the Vulnerable Software and Affected Versions Texas Instruments CC256xC-BT-SP versions 1.2 Texas Instruments CC256xB-BT-SP version 1.8 Texas Instruments WL18xx-BT-SP version 4.4 Description The issue allows remote attackers to trigger a buffer overflow via a malformed Bluetooth Low Energy...

CVE-2010-2450

The keygen.sh script in Shibboleth SP 2.0 located in /usr/local/etc/shibboleth by default uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask default 22 instead of chmoding the resulting file itself, so the generated private key is world readable by...

CVE-2010-2450

The keygen.sh script in Shibboleth SP 2.0 located in /usr/local/etc/shibboleth by default uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask default 22 instead of chmoding the resulting file itself, so the generated private key is world readable by...

Default credentials

The keygen.sh script in Shibboleth SP 2.0 located in /usr/local/etc/shibboleth by default uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask default 22 instead of chmoding the resulting file itself, so the generated private key is world readable by...

CVE-2010-2450

The keygen.sh script in Shibboleth SP 2.0 located in /usr/local/etc/shibboleth by default uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask default 22 instead of chmoding the resulting file itself, so the generated private key is world readable by...

CVE-2010-2450

CVE-2010-2450 affects Shibboleth SP 2.0. The keygen.sh utility (in /usr/local/etc/shibboleth by default) uses OpenSSL to generate a DES private key and saves it to sp-key.pm with the process’s root umask (default 022). This results in the private key file being world-readable by default, exposing...

CVE-2010-2450

The keygen.sh script in Shibboleth SP 2.0 located in /usr/local/etc/shibboleth by default uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask default 22 instead of chmoding the resulting file itself, so the generated private key is world readable by...

PT-2019-6543

Name of the Vulnerable Software and Affected Versions Shibboleth SP version 2.0 Description The keygen.sh script in Shibboleth SP uses OpenSSL to create a DES private key, which is placed in sp-key.pm. This script relies on the root umask instead of setting the permissions for the resulting file,...

CVE-2010-2450: Exposure of Sensitive Information to an Unauthorized Actor

The keygen.sh script in Shibboleth SP 2.0 located in /usr/local/etc/shibboleth by default uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask default 22 instead of chmoding the resulting file itself, so the generated private key is world readable by...

sp-sunshine.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-994268 Security Researcher Disst Helped patch 864 vulnerabilities Received 3 Coordinated Disclosure badges Received 3 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting sp-sunshine.com website and its...

BlockDev Sp. Z o.o: Two-factor authentication (2FA) Bypass

Bypassing 2FA after activating it on the company forum...

CVE-2015-9448

The CVE-2015-9448 issue affects the WordPress SendPress plugin (versions prior to 1.2). The vulnerability is an SQL Injection in the wp-admin/admin.php?page=sp-queue listid parameter. Impact per sources includes manipulation/exfiltration of data via the web interface, with CVSS scores indicating ...

PT-2019-7407

Name of the Vulnerable Software and Affected Versions sendpress plugin versions prior to 1.2 Description The issue allows for SQL Injection via the "listid" parameter in the wp-admin/admin.php?page=sp-queue endpoint. Recommendations For versions prior to 1.2, update to version 1.2 or later to...

Unspecified Vulnerability in Intel Xeon E5, Intel Xeon E7, and Xeon SP

Intel Xeon E5 is a central processing unit CPU of the Xeon Xeon E5 series, Intel Xeon E7 is a central processing unit CPU of the Xeon Xeon E7 series, and Intel Xeon SP is a scalable central processing unit CPU. （The Intel Xeon SP is a scalable central processing unit CPU product. A security...

PT-2019-8539

Name of the Vulnerable Software and Affected Versions spotim-comments plugin versions prior to 4.0.4 Description The issue concerns multiple XSS problems. Recommendations For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue...

Partial Information Disclosure Advisory

Summary: A potential security vulnerability in some microprocessors with Intel® Data Direct I/O Technology Intel® DDIO and Remote Direct Memory Access RDMA may allow partial information disclosure via adjacent access. Vulnerability Details: CVEID: CVE-2019-11184 Description: A race condition in...