CVE-2019-1861

Cisco Industrial Network Director (IND) remote code execution (CVE-2019-1861) is caused by improper validation of uploaded files in the software update feature. An authenticated administrator can upload an arbitrary file, leading to code execution with elevated privileges. Affected are IND releas...

CVE-2019-1861 Cisco Industrial Network Director Remote Code Execution Vulnerability

A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of files uploaded to the affected application. An attacker could exploit this vulnerability ...

Cisco Industrial Network Director Remote Code Execution Vulnerability

A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of files uploaded to the affected application. An attacker could exploit this vulnerability ...

SUSE-SU-2019:14068-1 Security update for mailman

This update for mailman fixes the following issues: Security issue fixed: - CVE-2016-6893: Fixed a Cross-site request forgery vulnerability in the admin web interface bsc997205. Following bug was fixed: - Allow CSRF check to pass in mailman web frontend if the list name contains a '+' bsc1102416...

Duplicate Advisory: Command Injection in fs-git

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wp3j-gv53-4pg8. This link is maintained to preserve external references. Original Description Affected versions of fs-git do not sanitize strings passed into the buildCommand method, resulting in arbitrary code...

Out-of-bounds Read in concat-with-sourcemaps

Versions of concat-with-sourcemaps before 1.0.6 allocates uninitialized Buffers when a number is passed as a separator. Recommendation Update to version 1.0.6 or later...

SUSE-SU-2019:1354-1 Security update for screen

This update for screen fixes the following issues: Security issue fixed: - CVE-2015-6806: Fixed a stack overflow due to deep recursion bsc944458. Non-security issue fixed: - Fixed segmentation faults related to altscreen and resizing screen bsc1130831...

SUSE-SU-2019:1339-1 Security update for bluez

This update for bluez fixes the following issues: Security vulnerability addressed: - CVE-2016-9797: Fixed a buffer over-read in l2capdump bsc1013708. - CVE-2016-9798: Fixed a use-after-free in confopt bsc1013712. - CVE-2016-9917: Fixed a heap-based buffer overflow in readn bsc1015171. -...

CVE-2019-12295

In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion...

Cryptographically Weak PRNG in generate-password

Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords. Recommendation Update to version 1.4.1 or later...

JVN#71498764: Apache Camel vulnerable to XML external entity injection (XXE)

Apache Camel provided by The Apache Software Foundation contains an XML external entity injection XXE vulnerability CWE-611 due to using an outdated vulnerable JSON-lib library. Impact By processing a specially crafted request, an arbitrary file on the server may be read. Solution Update the...

DLA-1796-1 jruby - security update

Bulletin has no description...

eXtplorer 2.1.12 various

eXtplorer 2.1.12 various Update Notice URL https://extplorer.net/news/24...

DLA-1792-2 cups-filters - regression update

Bulletin has no description...

Security Advisory - MITM Vulnerability on Huawei Share

There is a man-in-the-middleMITM vulnerability on Huawei Share of certain smartphones. When users establish connection and transfer data through Huawei Share, an attacker could sniffer, spoof and do a series of operations to intrude the Huawei Share connection and launch a man-in-the-middle attac...

Path Traversal

Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for ...

Fuji Electric Alpha7 PC Loader

1. EXECUTIVE SUMMARY CVSS v3 3.3 ATTENTION: Low skill level to exploit Vendor: Fuji Electric Equipment: Alpha7 PC Loader Vulnerability: Out-of-bounds Read 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the device. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The...

Cisco NX-OS Software NX-API Sandbox Cross-Site Scripting Vulnerability

A vulnerability in the NX API NX-API Sandbox interface for Cisco NX-OS Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the NX-API Sandbox interface of an affected device. The vulnerability is due to insufficient validation of...

Cisco IOS XR Software BGP MPLS-Based EVPN Denial of Service Vulnerability

A vulnerability in the Border Gateway Protocol BGP Multiprotocol Label Switching MPLS-based Ethernet VPN EVPN implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a denial of service DoS condition on an affected device. The vulnerability is due to a...

Cisco NX-OS Software Command Injection Vulnerability (CVE-2019-1770)

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments...