Input validation

IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043...

CVE-2019-4637

CVE-2019-4637 affects IBM Security Secret Server. The vulnerability stems from incomplete blocklisting used for input validation in Secret Server 10.7, allowing attackers to bypass application controls and potentially impact system integrity and data. IBM’s security bulletin notes this issue has ...

Design/Logic Flaw

On impacted versions and platforms the Trusted Platform Module TPM system integrity check cannot detect modifications to specific system components. This issue only impacts specific engineering hotfixes and platforms. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or...

CVE-2019-4556

IBM QRadar Advisor 1.0.0 through 2.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 166205...

patch: do_ed_script in pch.c does not block strings beginning with a ! character

A flaw was found in GNU patch through version 2.7.6. Strings beginning with a exclamation mark are not blocked by default. When ed receives an exclamation mark-prefixed command line argument, the argument is executed as a shell command. The highest threat from this vulnerability is to data...

kernel: net-sysfs: *_queue_add_kobject refcount issue

A flaw was found in the way the rxqueueaddkobject and netdevqueueaddkobject functions in the Linux kernel handled refcounting of certain objects. This flaw allows a local user who can trigger the error code path to use this vulnerability to disturb the integrity of the system...

CVE-2019-4329

IBM Security Guardium Big Data Intelligence SonarG 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209...

CVE-2019-2959

Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion component: Security Models. The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion Financial Reporting...

The vulnerability of the fly-admin-mic component in the FLY operating environment of the Astra Linux system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the fly-admin-mic component in the FLY operating environment of the Astra Linux system is related to a flaw in the file system integrity checking mechanism. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of UEFI (BIOS) software in desktop computers, personal computers, and payment devices manufactured by Hewlett-Packard Development Company L.P. is related to code errors that allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of UEFI BIOS software in desktop computers, personal computers, and payment devices manufactured by Hewlett-Packard Development Company L.P. is related to code errors. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibili...

Design/Logic Flaw

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Open Fabrics Tools. The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris executes to compromise...

CVE-2019-0328

ABAP Tests Modules SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5 of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system...

python-jinja2: str.format_map allows sandbox escape

A flaw was found in Jinja. Python string formatting could allow an attacker to escape the sandbox. The highest threat from this vulnerability is to data confidentiality and integrity and system availability...

python-jinja2: Sandbox escape due to information disclosure via str.format

A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity a...

python-jinja2: Sandbox escape due to information disclosure via str.format

A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity a...

Philips Tasy EMR (Update A)

1. EXECUTIVE SUMMARY --------- Begin Update A Part 1 of 7 --------- CVSS v3 4.3 ATTENTION: Low skill level to exploit --------- End Update A Part 1 of 7 --------- Vendor: Philips Equipment: Tasy EMR --------- Begin Update A Part 2 of 7 --------- Vulnerability: Cross-site Scripting, Information...

Apple macOS High Sierra, OS X El Capitan and macOS Sierra SIP Component Misconfiguration Vulnerability

Apple macOS Sierra is a specialized operating system for Mac computers. apple macOS High Sierra is a product of Apple Inc. apple macOS High Sierra is a specialized operating system for Mac computers. apple OS X El Capitan is a specialized operating system for Mac computers. apple OS X El Capitan ...

Design/Logic Flaw

Vulnerability in the Oracle Content Manager component of Oracle E-Business Suite subcomponent: Cover Letter. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2019-2498

Vulnerability in the Oracle Partner Management component of Oracle E-Business Suite subcomponent: Partner Dash board. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacke...

Fedora 29 : rpm (2018-89a3999673)

An unfortunate regression in rpm 4.14.2 causes --setperms to behave incorrectly on symbolic links: file and directory permissions become world-writable and executable on symlink targets. A similar flaw exists in --setugids, but it is less exploitable. If you have used --setperms or --setugids, or...