Security Bulletin: A vulnerability in IBM Websphere Application Server affects the IBM Performance Management product (CVE-2019-4305)

Summary A vulnerability in IBM Websphere Application Server - Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM Performance Management has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-4305 DESCRIPTION: IBM...

Authorization Bypass

php is vulnerable to authorization bypass. A flaw was found in the handling of the "mbstring.funcoverload" configuration setting. A value set for one virtual host, or in a user's .htaccess file, was incorrectly applied to other virtual hosts on the same server, causing the handling of multibyte...

Microsoft NET USE win10 - Insufficient Authentication Logic Exploit

Title: Microsoft NET USE win10 - Insufficient Authentication Logic Date: 2020-04-04 Author: hyp3rlinx Vendor: www.microsoft.com CVE: N/A + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

CVE-2020-8146

In UniFi Video v3.10.1 for Windows 7/8/10 x64 there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. The issue was fixed by adjusting the .tsExport folder when the controller is running on Windows and adjusting the SafeDllSearchMode in the...

CVE-2020-6999: Buffer Copy without Checking Size of Input

In Moxa EDS-G516E Series firmware, Version 5.2 or lower, some of the parameters in the setting pages do not ensure text is the correct size for its buffer...

PT-2020-19328

Name of the Vulnerable Software and Affected Versions Moxa EDS-G516E Series firmware versions 5.2 or lower Description The issue arises from some parameters in the setting pages not ensuring text is the correct size for its buffer. This can potentially lead to issues related to buffer handling...

CVE-2020-9759

A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files...

Design/Logic Flaw

A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files...

CVE-2020-9759

A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files...

CVE-2020-9759 webOS TV Emulator privilege escalation vulnerability

A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files...

CVE-2020-9759

A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files...

Canon Oce Colorwave 500 cross-site scripting vulnerability (CNVD-2020-18988)

The Canon Oce Colorwave 500 is a printer from Canon Japan. A cross-site scripting vulnerability exists in the 'settingId' parameter of the settingDialogContent.jsp page of the web application in Canon Oce Colorwave 500 version 4.0.0.0. The vulnerability stems from a lack of proper validation of...

UBUNTU-CVE-2019-13457

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their "company" tickets with the same CustomerID, even when the CustomerDisableCompanyTicketAccess setting is turned on...

Security Bulletin: IBM MQ Console and REST API could expose sensitive information to an attacker. (CVE-2019-4305)

Summary IBM WebSphere Liberty profile, which is used to host the IBM MQ Console and REST API, could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2019-4305 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain...

CVE-2020-3873

This issue was addressed with improved setting propagation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Turning off "Load remote content in messages” may not apply to all mail previews...

CVE-2020-3873

This issue was addressed with improved setting propagation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Turning off "Load remote content in messages” may not apply to all mail previews...

Design/Logic Flaw

This issue was addressed with improved setting propagation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Turning off "Load remote content in messages” may not apply to all mail previews...

PT-2020-17766

Name of the Vulnerable Software and Affected Versions iOS versions prior to 13.3.1 iPadOS versions prior to 13.3.1 Description This issue was addressed with improved setting propagation. Turning off "Load remote content in messages” may not apply to all mail previews. Recommendations For iOS...

CVE-2020-3873: Undefined Security Weakness

This issue was addressed with improved setting propagation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Turning off "Load remote content in messages” may not apply to all mail previews...

Cross-site Request Forgery Vulnerability in RICOH printers

Overview Multiple RICOH printers contain Cross-site Request Forgery CWE-352. RICOH COMPANY, LTD. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and RICOH COMPANY, LTD. coordinated under the Information Security Early Warning Partnership. Impact If a user...