CVE-2019-9730

Incorrect access control in the CxUtilSvc component of the Synaptics Sound Device drivers prior to version 2.29 allows a local attacker to increase access privileges to the Windows Registry via an unpublished API...

CVE-2019-9730

CVE-2019-9730 concerns the Synaptics (formerly Conexant) Audio driver. Affected component is the CxUtilSvc/CxUtilSrv.exe within the Sound Device Driver, where an incorrect access control allows a local user to escalate privileges to the Windows Registry via an unpublished API. Impact: local privi...

Exploit for Improper Input Validation in Microsoft

CVE-2019-0708 BlueKeep Exploit CVE-2019-07...

Synaptics Audio Driver Vulnerability - Lenovo Support US

No description provided...

PT-2019-2538

Name of the Vulnerable Software and Affected Versions Synaptics Sound Device drivers versions prior to 2.29 Description The issue is related to insufficient access control in the CxUtilSvc component of the Synaptics Sound Device drivers. This can be exploited by a local attacker to elevate...

Shopify: Unpublished Product Images can be disclosed

Hi, This looks like a minor issue but felt like it was something worth reporting. Ideally, a product can be published or remain unpublished on any sales channel. If a product remains unpublished, then no information regarding it must be visible to public including product pictures. But I found an...

Urban Dictionary: Users able to set video url for unpublished words and able to see the name of unpublished words

Summary Users will be able to set youtube video URL to unpublished words and will be able to see names of an unpublished word. Description Once a user publishes a word and later unpublish it, others user still would be able to set the youtube video URL for it and will be able to see the name of t...

DRUPAL-CONTRIB-2019-004

The Preview Link module enables you to generate preview links so anonymous users can access unpublished revisions of content. The last release of the module introduced an access bypass allowing users to present invalid tokens but still access unpublished content...

PT-2019-20513

The Preview Link module enables you to generate preview links so anonymous users can access unpublished revisions of content. The last release of the module introduced an access bypass allowing users to present invalid tokens but still access unpublished content...

Preview Link - Moderately critical - Access bypass - SA-CONTRIB-2019-004

The Preview Link module enables you to generate preview links so anonymous users can access unpublished revisions of content. The last release of the module introduced an access bypass allowing users to present invalid tokens but still access unpublished content...

GHSA-3RH7-VM4X-Q2HP sqlserver is malware

The sqlserver package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security conce...

Joomla! 3.3.x < 3.8.8 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - ACL violation in access levels affects Joomla 2.5.0 through 3.8.7 - Adding phar files to the upload blacklist affects Joomla 2.5.0 through 3.8.7 - Information Disclosure abo...

DRUPAL-CONTRIB-2018-071

This module enables you to resolve the provided Drupal path in order to find the canonical path and information about the resolved entity. This information includes entity type ID, entity ID, entity UUID and entity label. The module doesn't sufficiently check access before displaying entity label...

DRUPAL-CONTRIB-2018-067

The Workbench Moderation module adds arbitrary moderation states to Drupal core's "unpublished" and "published" node states, and affects the behavior of node revisions when nodes are published. In some conditions, content moderation fails to check a users access to use certain transitions, leadin...

Renderkit - Moderately critical - Access bypass - SA-CONTRIB-2018-060

This module, typically in combination with cfr:cfrplugin, allows to compose behaviors from granular components. One of such behaviors is to display a list of related entities, for a given source entity and a given entity relation e.g. an entity reference field. The components that display related...

GHSA-5CV7-R488-WC5X noderequest is malware

The noderequest package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security...

noderequest is malware

The noderequest package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security...

opencv.js is malware

opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

GHSA-5HXW-R847-QFWP opencv.js is malware

opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

coffe-script is malware

The coffe-script package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation If you have found coffe-script installed in your...