CVE-2019-11396

An issue was discovered in Avira Free Security Suite 10. The permissive access rights on the SoftwareUpdater folder files / folders and configuration are incompatible with the privileged file manipulation performed by the product. Files can be created that can be used by an unprivileged user to...

Apple Releases iOS 12.4.1 Emergency Update to Patch 'Jailbreak' Flaw

Apple just patched an unpatched flaw that it patched previously but accidentally unpatched recently — did I confuse you? Let's try it again... Apple today finally released iOS 12.4.1 to fix a critical jailbreak vulnerability, like it or not, that was initially patched by the company in iOS 12.3 b...

Apple Fixes iOS Flaw That Opened iPhones to Jailbreaks

Apple has released an emergency patch fixing a kernel vulnerability – for the second time – after it was accidentally unpatched in iOS 12.4. The flaw CVE-2019-8605, a use-after-free issue existing in the kernel, could enable a malicious application to execute arbitrary code with system privileges...

Deserialization of untrusted data

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget contained in a serialized object may...

CVE-2019-11031

CVE-2019-11031 affects Mirasys VMS before v7.6.1 and 8.x before v8.3.2. The flaw arises from mishandling the auto-update feature (IDVRUpdateService2 in DVRServer.exe), enabling an attacker to upload files via a Setup-Files action and then execute them with SYSTEM privileges. Impact is high, with ...

CVE-2019-11030

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget contained in a serialized object may...

CVE-2019-11030

Mirasys VMS (before v7.6.1 and before v8.3.2) is affected by CVE-2019-11030 due to insecure deserialization in Mirasys.Common.Utils.Security.DataCrypt within Common.dll (AuditTrailService in SMServer.exe). The vulnerability allows execution of a gadget contained in a serialized object with SYSTEM...

CVE-2019-15105

An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a...

CVE-2019-12808

ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges...

CVE-2019-12808

ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges...

Privilege escalation

ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges...

CVE-2019-12808

ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges...

About the security content of watchOS 5 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

Unspecified Vulnerability in Apple macOS Multiple Component

Apple macOS Mojave is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in the Grapher component of Apple macOS Mojave versions prior to 10.14.6. An attacker can exploit the vulnerability to execute arbitrary code with system privileges...

Unspecified vulnerability in Apple macOS Multiple component (CNVD-2019-28857)

Apple macOS Mojave is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in the Grapher component of Apple macOS Mojave versions prior to 10.14.6. An attacker can exploit the vulnerability to execute arbitrary code with system privileges...

Unspecified vulnerability in Apple macOS Multiple component (CNVD-2019-28859)

Apple macOS Mojave is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in the Grapher component of Apple macOS Mojave versions prior to 10.14.6. An attacker can exploit the vulnerability to execute arbitrary code with system privileges...

Apple macOS Multiple Arbitrary Code Execution Vulnerability (CNVD-2019-25207)

Apple macOS Mojave is a specialized operating system developed by Apple for Mac computers. An arbitrary code execution vulnerability exists in the Disk Management component and Security component in Apple macOS Mojave versions prior to 10.14.6. An attacker can exploit this vulnerability to execut...

Apple Mac OS X Security Updates (HT210348)-04

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-3969

Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Local Privilege Escalation due to CmdAgent's handling of COM clients. A local process can bypass the signature check enforced by CmdAgent via process hollowing which can then allow the process to invoke sensitive COM methods in CmdAgen...

CVE-2019-3969: Comodo Antivirus Privilege Escalation

Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Local Privilege Escalation due to CmdAgent’s handling of COM clients. A local process can bypass the signature check enforced by CmdAgent via process hollowing which can then allow the process to invoke sensitive COM methods in CmdAgen...