Security Advisory - Improper Access Control Vulnerability in Huawei Share

There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to certain file from certain application. An attacker tricks the user into installing a malicious application then establishing a connect to the attacker through Huawei Share,...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution Vulnerability

A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating...

TIBCO EBX Add-on CVE-2019-17331 Cross Site Scripting Vulnerability

Description TIBCO EBX Add-on is prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let t...

PT-2019-4216 · Adobe · Media Encoder

Name of the Vulnerable Software and Affected Versions: Adobe Media Encoder versions 13.1 and earlier Description: The issue is related to an out-of-bounds write vulnerability in memory. This could allow a remote attacker to execute arbitrary code on the target system. Recommendations: For Adobe...

Adobe Illustrator CVE-2019-7962 DLL Loading Privilege Escalation Vulnerability

Description Adobe Illustrator is prone to a privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Adobe Illustrator CC version 23.1 and prior are vulnerable. Technologies Affected Adobe Illustrator CC 19 Adobe Illustrator CC 21 Adobe Illustrator CC 22...

PT-2022-2346 · Mariadb +10 · Mariadb Server +10

Name of the Vulnerable Software and Affected Versions: MariaDB Server versions 10.7 and below Description: The issue is related to a segmentation fault in the sql/sql class.cc component of the MariaDB Server. It is associated with the lack of protection for the SQL query structure, which can be...

MGASA-2019-0319 Updated freetds packages fix security vulnerability

Updated freetds packages fix security vulnerability: Felix Wilhelm discovered that FreeTDS incorrectly handled certain types after a protocol downgrade. A remote attacker could use this issue to cause FreeTDS to crash, resulting in a denial of service, or possibly execute arbitrary code...

MGASA-2019-0315 Updated firefox packages fix security vulnerabilities

The updated packages fix several bugs and some security issues: Use-after-free when creating index updates in IndexedDB. CVE-2019-11757 Potentially exploitable crash due to 360 Total Security. CVE-2019-11758 Stack buffer overflow in HKDF output. CVE-2019-11759 Stack buffer overflow in WebRTC...

MGASA-2019-0320 Updated chromium-browser-stable packages fix security vulnerabilities

Chromium-browser 78.0.3904.87 fixes security issues: Multiple flaws were found in the way Chromium 77.0.3865.120 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information...

Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint CE, Cisco TelePresence Codec TC, and Cisco RoomOS Software could allow an authenticated, remote attacker to escalate privileges to an unrestricted user of the restricted shell. The vulnerability is due to insufficient input...

Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability

A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially...

Cisco Industrial Network Director Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Industrial Network Director IND could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected application. The vulnerability is due to insufficient validati...

Security Bulletin: NVIDIA GeForce Experience - November 2019

NVIDIA has released a software security update for NVIDIA® GeForce Experience™. This update addresses issues that may lead to code execution, information disclosure, or denial of service. To protect your system, download and install this software update through the GeForce Experience Downloads...

ALEA-2019:3426 libpng15 bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

Intel CSME, Server Platform Services, Trusted Execution Engine, Intel Active Management Technology and Dynamic Application Loader Vulnerabilities - Lenovo Support US

No description provided...

OPENSUSE-SU-2019:2421-1 Security update for chromium

This update for chromium fixes the following issues: Chromium was updated to 78.0.3904.87 boo1155643: CVE-2019-13721: Use-after-free in PDFium CVE-2019-13720: Use-after-free in audio...

PHP 'FFI::cast()' Heap Based Memory Corruption Vulnerability

Description PHP is prone to a heap-based memory-corruption vulnerability. Successful exploits may allow the attacker to crash the affected application resulting in denial-of-service condition. Versions prior to PHP 7.4.0 are vulnerable. Technologies Affected PHP PHP 7.3.0 PHP PHP 7.3.1 PHP PHP...

PHP 'FFI::cast()' Memory Leak Denial of Service Vulnerability

Description PHP is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause a denial of service condition. Versions prior to PHP 7.4.0 are vulnerable. Technologies Affected PHP PHP 7.3.0 PHP PHP 7.3.1 PHP PHP 7.3.10 PHP PHP 7.3.11 PHP PHP 7.3.12 PHP PHP 7.3.2 PHP PHP...

MGASA-2019-0305 Updated graphviz packages fix security vulnerability

The updated packages fix a security vulnerability: The agroot function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graphml2gv. CVE-2019-11023...

Trend Micro Apex One CVE-2019-18188 Command Injection Vulnerability

Description Trend Micro Apex One is prone to a command-injection vulnerability because it fails to properly sanitize user-supplied input. Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts will...