CVE-2019-13658

CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...

Design/Logic Flaw

CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...

CVE-2019-13658

CA Network Flow Analysis versions 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to bypass authentication and execute arbitrary commands , compromising system security. The issue is documented across multiple sources (CVE-2019-13658 references and the Syma...

[SECURITY] [DLA 1933-1] ruby-nokogiri security update

Package : ruby-nokogiri Version : 1.6.3.1+ds-1+deb8u1 CVE ID : CVE-2019-5477 A command injection vulnerability in Nokogiri allows commands to be executed in a subprocess by Rubys Kernel.open method. For Debian 8 "Jessie", this problem has been fixed in version 1.6.3.1+ds-1+deb8u1. We recommend th...

CVE-2019-10421

Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Advantech WebAccess

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : Advantech Equipment : WebAccess Vulnerabilities : Code Injection, Command Injection, Stack-based Buffer Overflow, Improper Authorization 2. RISK EVALUATION Successful exploitation of these...

Arbitrary Code Execution (ACE)

firefox is vulnerable to arbitrary code execution. The vulnerability exists due to memory corruption which allows an attacker to execute arbitrary code on the system...

Design/Logic Flaw

IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 163681...

Arbitrary Code Execution

php is vulnerable to arbitrary code execution. A heap-based buffer over-read in the PHAR reading functions allows an attacker to execute arbitrary code on the system...

Moderate: Red Hat Security Advisory: sssd security, bug fix, and enhancement update

An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

3S-Smart Software Solutions GmbH CODESYS V3 (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low skill level to exploit Vendor: 3S-Smart Software Solutions GmbH Equipment: CODESYS V3 Vulnerability: Insufficiently Protected Credentials 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-19-213-04...

grapheneX - Automated System Hardening Framework

grapheneX In computing, hardening is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle a single-function system is more secure than a multipurpose one. Reducing available ways of attack typically...

[SECURITY] [DLA 1859-1] bind9 security update

Package : bind9 Version : 1:9.9.5.dfsg-9+deb8u18 CVE ID : CVE-2018-5743 A vulnerability was found in the Bind DNS Server. Limits on simultaneous tcp connections have not been enforced correctly and could lead to exhaustion of file descriptors. In the worst case this could affect the file...

New Azure Marketplace Pay-As-You-Go Billing for Trend Micro Deep Security as a Service

Cloud adoption continues to rise as organizations reduce their data center footprint, look to cloud native technologies to improve their application design and output, and strive to improve scalability and management of resources and systems. In a recent survey conducted by analyst firm ESG, 87% ...

Malicious Package

Overview Versions 0.1.2 and 0.1.3 of leetlog contain malicious code. The package adds an arbitrary hardcoded SSH key identified as hacker@evilmachine to the system's authorizedkeys Recommendation Any computer that has this package installed or running should be considered fully compromised. All...

Microsoft Windows splwow64 CVE-2019-0880 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges on the system. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems...

Denial Of Service (DoS)

unixauthservice in apache ranger is vulnerable to denial of service. Improper handling of user input allows an attacker to crash the application in a stack-based buffer overflow, or potentially execute arbitrary code on the system...

Directory Traversal

Overview rubygems-update is an inbuilt rubygem for updating rubygems. Affected versions of this package are vulnerable to Directory Traversal. Before making new directories or touching files which now include path-checking code for symlinks, it would delete the target destination. If that...

CVE-2017-1107

IBM Marketing Platform 9.1.0, 9.1.2, 10.0, and 10.1 exposes sensitive information in the headers that could be used by an authenticated attacker in further attacks against the system. IBM X-Force ID: 120906...

WESEEK GROWI Input Validation Error Vulnerability

WESEEK GROWI is a suite of team collaboration software from WESEEK Japan. An input validation error vulnerability exists in the login process in WESEEK GROWI 3.4.6 and prior versions. The vulnerability originates from a network system or product that does not properly validate input data. An...