py-psutil -- double free vulnerability

ret2libc reports: psutil aka python-psutil through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object...

CVE-2019-18874: Double Free

psutil aka python-psutil through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object...

CVE-2019-13557

In Tasy EMR, Tasy WebPortal Versions 3.02.1757 and prior, there is an information exposure vulnerability which may allow a remote attacker to access system and configuration information...

CVE-2019-8159

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection...

CVE-2019-8159

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection...

PT-2019-18935

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1, excluding 2.3.2-p1 Description A remote code execution issue exists, allowing an authenticated user with system data manipulation privileges to execute...

CVE-2019-8159: Improper Neutralization of Special Elements used in an OS Command

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection...

Remote Code Execution

Sonatype Nexus Repository Manager is vulnerable to remote code execution. An attacker with administrative access to NXRM is able to create repositories that can grant access to read/execute system data outside the scope of NXRM...

How to steal a million (of your data)

Any user data — from passwords for entertainment services to electronic copies of documents — is highly prized by intruders. The reason is simply that almost any information can be monetized. For instance, stolen data can be used to transfer funds to cybercriminal accounts, order goods or service...

Vulnerabilities fixed in libxslt

Suse has fixed vulnerabilities in libxslt. The vulnerabilities allow a locally authorized malicious person to obtain obtain system data. -= SUSE =- SUSE has made updates available to address the vulnerabilities fixes in SUSE 12. You can install these custom packages using 'YaST'. You can also...

Design/Logic Flaw

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to access potentially sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms. An attacker could...

Cisco Integrated Management Controller Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to access potentially sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms. An attacker could...

Vulnerability fixed in glib

A vulnerability has been fixed for Glib in Ubuntu. The vulnerabilities allow a malicious person to perform attacks that lead to the following categoriesn of damage: - Denial-of-Service DoS; - Manipulation of data; - Circumvention of security measure; - Access to sensitive data; - Access to system...

The vulnerability of Intel Core processors lies in the lack of protection for system data, which allows attackers to exploit this to disclose confidential information.

The vulnerability of Intel Core processors is related to the lack of protection for system data. Exploiting this vulnerability can allow attackers to disclose the protected information...

CB TAU Threat Intelligence Notification: HopLight Campaign (Linked to North Korea) is Reusing Substantial Amount of Code

On April 10, 2019 the US Department of Homeland Security DHS released a Malware Analysis Report MAR-10135536-8 which detailed the trojan HopLight. HopLight has been linked to different North Korean DPRK campaigns also known as the Lazarus Group. The CB Threat Analysis Unit TAU has continued to...

CVE-2018-13295

Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the version parameter...

Input Validation Vulnerability in Caret

Caret is a software package for plotting classification and regression models. An input validation vulnerability exists in versions of Caret prior to 2019-02-22 that originates from a networked system or product that does not properly validate incoming data. An attacker could exploit the...

CVE-2018-14979

The CVE-2018-14979 entry concerns ASUS ZenFone 3 Max (ASUS_X008_1) with pre-installed com.asus.loguploader. The issue is an exported service, LogUploaderService, accessible via a specific action, that can write a bugreport (kernel log, logcat, system service states including active notifications)...

Rockwell Automation Allen-Bradley 1752-EN2T/C / 1769-L33ER/A LOGIX5333ER XSS

Exploit Title: Rockwell Automation Allen-Bradley 1752-EN2T/C, 1769-L33ER/A LOGIX5333ER Cross Site Scripting Google Dork: N/A Date: 5/12/2018 Exploit Author: n4pst3r Vendor Homepage: https://www.rockwellautomation.com/ Software Link: unkn0wn Version: 1752-EN2T/C, 1769-L33ER/A LOGIX5333ER Tested on...

Rockwell Automation Allen-Bradley 1752-EN2T/C, 1769-L33ER/A Cross Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Rockwell Automation Allen-Bradley 1752-EN2T/C, 1769-L33ER/A LOGIX5333ER Cross Site Scripting Google Dork: N/A Date: 5/12/2018 Exploit Author: n4pst3r Vendor Homepage: https://www.rockwellautomation.com/ Software Link: unkn0...