Design/Logic Flaw

The "CLink4Service" service is installed with Corsair Link 4.9.7.35 with insecure permissions by default. This allows unprivileged users to take control of the service and execute commands in the context of NT AUTHORITY\SYSTEM, leading to total system takeover, a similar issue to CVE-2018-12441...

Improper Authorization in Fisheye & Crucible through ATST Plugin - CVE-2019-15005

The Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which was used in Fisheye & Crucible before version 4.7.2, allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. Th...

Improper Authorization in Crowd through ATST Plugin - CVE-2019-15005

The Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which was used in Crowd & Crowd Data Center before version 3.6.0, allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization...

OPENSUSE-SU-2019:2199-1 Security update for ibus

This update for ibus fixes the following issues: - CVE-2019-14822: Fixed misconfiguration of the DBus server allows to unprivileged user could monitor and send method calls to the ibus bus of another user bsc1150011. This update was imported from the SUSE:SLE-15-SP1:Update update project...

openSUSE Security Update : ibus (openSUSE-2019-2174)

This update for ibus fixes the following issues : Security issue fixed : - CVE-2019-14822: Fixed a misconfiguration of the DBus server that allowed an unprivileged user to monitor and send method calls to the ibus bus of another user. bsc1150011 This update was imported from the SUSE:SLE-15:Updat...

OPENSUSE-SU-2019:2174-1 Security update for ibus

This update for ibus fixes the following issues: Security issue fixed: - CVE-2019-14822: Fixed a misconfiguration of the DBus server that allowed an unprivileged user to monitor and send method calls to the ibus bus of another user. bsc1150011 This update was imported from the SUSE:SLE-15:Update...

Security update for ibus (important)

openSUSE Security Update: Security update for ibus Announcement ID: openSUSE-SU-2019:2174-1 Rating: important References: 1150011 Cross-References: CVE-2019-14822 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for ibus fixes...

EulerOS 2.0 SP3 : samba (EulerOS-SA-2019-2018)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS...

SUSE SLED15 / SLES15 Security Update : ibus (SUSE-SU-2019:2427-1)

This update for ibus fixes the following issues : CVE-2019-14822: Fixed misconfiguration of the DBus server allows to unprivileged user could monitor and send method calls to the ibus bus of another user bsc1150011. Note that Tenable Network Security has extracted the preceding description block...

SUSE-SU-2019:2427-1 Security update for ibus

This update for ibus fixes the following issues: - CVE-2019-14822: Fixed misconfiguration of the DBus server allows to unprivileged user could monitor and send method calls to the ibus bus of another user bsc1150011...

kernel: broken permission and object lifetime handling for PTRACE_TRACEME

A flaw was found in the way PTRACETRACEME functionality was handled in the Linux kernel. The kernel's implementation of ptrace can inadvertently grant elevated permissions to an attacker who can then abuse the relationship between the tracer and the process being traced. This flaw could allow a...

DEBIAN-CVE-2019-14821

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvmcoalescedmmio' object, wherein write indices 'ring-first' and 'ring-last'...

Fedora 29 : systemd (2019-8a7dfdf1f3)

Security issue: unprivileged users were allowed to change DNS servers configured in systemd-resolved CVE-2019-15718 - hwdb entries for keyboards are updated to the latest version 1725717 No need to log out or reboot. Note that Tenable Network Security has extracted the preceding description block...

[SECURITY] [DSA 4525-1] ibus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4525-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 18, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4525-1] ibus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4525-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 18, 2019 https://www.debian.org/security/faq -...

CVE-2019-14822

A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is usi...

Improper Authorization in Bitbucket Server through ATST Plugin - CVE-2019-15005

The Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which was used in Bitbucket Server & Bitbucket Data Center before version 6.6.0, allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing...

Improper Authorization in Bitbucket Server through ATST Plugin - CVE-2019-15005

The Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which was used in Bitbucket Server & Bitbucket Data Center before version 6.6.0, allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing...

kernel: ppc: unrelated processes being able to read/write to each other's virtual memory

A flaw was found in the way the Linux kernel's memory subsystem on certain 64-bit PowerPCs with the hash page table MMU handled memory above 512TB. A local, unprivileged user could use this flaw to escalate their privileges on the system...

kernel: Memory corruption due to incorrect socket cloning

A possible memory corruption due to a type confusion was found in the Linux kernel in the skclonelock function in the net/core/sock.c. The possibility of local escalation of privileges cannot be fully ruled out for a local unprivileged attacker...