DLA-1643-1 krb5 - security update

Bulletin has no description...

Cisco Enterprise NFV Infrastructure Software Linux Shell Access Vulnerability

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation in the affected software. An...

Cisco IoT Field Network Director Resource Exhaustion Denial of Service Vulnerability

A vulnerability in the UDP protocol implementation for Cisco IoT Field Network Director IoT-FND could allow an unauthenticated, remote attacker to exhaust system resources, resulting in a denial of service DoS condition. The vulnerability is due to improper resource management for UDP ingress...

Multiple Privilege Escalation Vulnerabilities in Cisco SD-WAN Solution

Multiple vulnerabilities in the local CLI of the Cisco SD-WAN Solution could allow an authenticated, local attacker to escalate privileges and modify device configuration files. The vulnerabilities exist because user input is not properly sanitized for certain commands at the CLI. An attacker cou...

Cisco SD-WAN Solution Arbitrary File Overwrite Vulnerability

A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the save command in the CLI of the affected software. An...

Cisco SD-WAN Solution Buffer Overflow Vulnerability

A vulnerability in the vContainer of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to cause a denial of service DoS condition and execute arbitrary code as the root user. The vulnerability is due to improper bounds checking by the vContainer. An attacker could exploit th...

Cisco Webex Meetings Server Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient validation...

MGASA-2019-0044 Updated podofo packages fix security vulnerabilities

The podofo package has been updated to fix several security issues...

MGASA-2019-0050 Updated libcaca packages fix security vulnerabilities

It was discovered that libcaca incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service CVE-2018-20544. It was discovered that libcaca incorrectly handled certain images. An attacker could possibly use this issue to execute arbitrary code...

OpenSC CVE-2019-6502 Memory Leak Denial of Service Vulnerability

Description OpenSC is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service conditions. OpenSC version 0.19.0 is vulnerable; other versions may also be affected. Technologies Affected Opensc-Project Opensc 0.19.0 Recommendations Permit local...

MGASA-2019-0039 Updated gthumb packages fix security vulnerability

An issue was discovered in gThumb through 3.6.2. There is a double-free vulnerability in the addthemesfromdir method in dlg-contact-sheet.c because of two successive calls of gfree, each of which frees the same buffer. CVE-2018-18718...

Security Advisory - Race Condition Vulnerability on Several Smartphones

There is a race condition vulnerability on certain driver of smartphone. An attacker tricks the user into installing a malicious application, which make multiple processes to operate the same variate at the same time. Successful exploit could cause execution of malicious code. Vulnerability ID:...

Cisco Email Security Appliance Memory Corruption Denial of Service Vulnerability

A vulnerability in the Secure/Multipurpose Internet Mail Extensions S/MIME Decryption and Verification or S/MIME Public Key Harvesting features of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause an affected device to corrupt...

Intel® PROSet/Wireless WiFi Software Advisory

Summary: A potential security vulnerability in Intel® PROSet/Wireless WiFi Software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2018-12177 Description: Improper directory permissions in the...

MGASA-2019-0014 Updated libpgf packages fix security vulnerability

Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32 CVE-2015-6673...

DLA-1622-1 debian-security-support - security update

Bulletin has no description...

MGASA-2018-0490 Updated monit packages fix security vulnerability

There is a use-after-free in monit that shows up if you run it for a while on an active system with address sanitizer enabled...

cordova-plugin-ionic-webview vulnerable to path traversal

Overview cordova-plugin-ionic-webview provided by npm, Inc. contains a path traversal vulnerability CWE-22 . This vulnerability was first reported to npm, Inc. by the below reporters then also reported to IPA. Based on the coordination request made by the reporters, JPCERT/CC coordinated with npm...

MGASA-2018-0486 Updated phpmyadmin packages fix security vulnerabilities

XSS vulnerability in navigation tree was discovered - Local file inclusion through transformation feature...

CVE-2018-1000828

FrostWire version = frostwire-desktop-6.7.4-build-272 contains a XML External Entity XXE vulnerability in Man in the middle on update that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the middle the call to...