FreeBSD-SA-20:03.thrmisc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:03.thrmisc Security Advisory The FreeBSD Project Topic: kernel stack data disclosure Category: core Module: kernel Announced: 2020-01-28 Credits: Ilja Van...

Security Bulletin: IBM API Connect is impacted by a vulnerability in Elastic Logstash (CVE-2019-7612)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-7612 DESCRIPTION: A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash...

CVE-2019-16468

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an user interface injection vulnerability. Successful exploitation could lead to sensitive information disclosure...

CVE-2019-18267

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

Cross site scripting

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

The vulnerability of the RDP protocol implementation in Windows operating systems allows attackers to disclose sensitive information.

The vulnerability of the RDP protocol implementation in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability allows a malicious actor to disclose sensitive information through a specially created application...

Smule: stored xss in https://www.smule.com

hi team , I found a stored xss in www.smule.com Summary: add summary of the vulnerability The most damaging type of XSS is Stored XSS Persistent XSS. An attacker uses Stored XSS to inject malicious content referred to as the payload, most often JavaScript code, into the target application. If the...

CVE-2019-18227

Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data...

CVE-2019-18227

CVE-2019-18227 affects Advantech WISE-PaaS/RMM, versions 3.3.29 and prior. The vulnerability is an XML External Entity (XXE) processing flaw in the RecoveryMgmt/AccountMgmt/other XML parsing paths that can allow a remote attacker to disclose sensitive data from the target system. Public descripti...

SQL injection vulnerability in zzzphp sa***.php page

zzphp is a free website builder developed in PHP language. A SQL injection vulnerability exists in the zzzphp sa.php page, which can be exploited by attackers to obtain sensitive information...

CVE-2019-5538

Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance 6.7 before 6.7u3a and 6.5 before 6.5u3d may allow a malicious actor to intercept sensitive data in transit over SCP...

CVE-2019-8087

Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure...

CVE-2019-8086

Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure...

CVE-2019-8081

Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have an authentication bypass vulnerability. Successful exploitation could lead to sensitive information disclosure...

CVE-2019-8079

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure...

Vulnerability of the Server component: The “libmysqld” component of the MySQL Server database management system, which allows attackers to disclose sensitive information.

The vulnerability of the Server component, “libmysqld” of the MySQL Server database management system, is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to disclose sensitive information...

The vulnerability of RDP servers on Windows operating systems, which allows attackers to disclose sensitive information

The vulnerability of RDP servers on Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability allows a malicious actor to disclose sensitive information through a specially created application...

Microsoft Font Subsetting - DLL Heap-Based Out-of-Bounds read in WriteTableFromStructure

-----===== Background =====----- The Microsoft Font Subsetting DLL fontsub.dll is a default Windows helper library for subsetting TTF fonts; i.e. converting fonts to their more compact versions based on the specific glyphs used in the document where the fonts are embedded. It is used by Windows G...

Microsoft Font Subsetting - DLL Heap-Based Out-of-Bounds read in FixSbitSubTableFormat1

Microsoft Font Subsetting - DLL Heap-Based Out-of-Bounds read in FixSbitSubTableFormat1 -----===== Background =====----- The Microsoft Font Subsetting DLL fontsub.dll is a default Windows helper library for subsetting TTF fonts; i.e. converting fonts to their more compact versions based on the...

Microsoft Font Subsetting - DLL Heap-Based Out-of-Bounds read in WriteTableFromStructure

Microsoft Font Subsetting - DLL Heap-Based Out-of-Bounds read in WriteTableFromStructure -----===== Background =====----- The Microsoft Font Subsetting DLL fontsub.dll is a default Windows helper library for subsetting TTF fonts; i.e. converting fonts to their more compact versions based on the...