PT-2020-6218 · Libbsd +4 · Libbsd +4

Name of the Vulnerable Software and Affected Versions: libbsd versions prior to 0.10.0 Description: The issue is related to an out-of-bounds read in the nlist.c file of the libbsd library. This occurs during a comparison for a symbol name from the string table strtab. The exploitation of this iss...

PT-2020-18292 · Phpgurukul · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System in PHP version 4.0 Description: The issue concerns multiple Persistent XSS vulnerabilities. Recommendations: For version 4.0, update to a newer version that contains a fix for this issue, if available. At...

PT-2020-5163 · Pillow +3 · Pillow +3

Name of the Vulnerable Software and Affected Versions: Pillow versions prior to 6.2.2 Description: The issue is related to a buffer overflow in the PCX P mode of the Pillow library when encoding images. This could allow a remote attacker to cause a denial of service. Recommendations: For versions...

SUSE-SU-2019:3393-1 Security update for python-azure-agent

This update for python-azure-agent fixes the following issues: Update to version 2.2.45 jscECO-80 bsc1159639 + Add support for Gen2 VM resource disks + Use alternate systemd detection + Fix /proc/net/route requirement that causes errors on FreeBSD + Add cloud-init auto-detect to prevent multiple...

CVE-2019-7184

This cross-site scripting XSS vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions...

The vulnerability of Modicon microprogrammed controllers lies in the lack of version checking for installed software updates. This allows a malicious individual to download an unpatched version of the installed software via FTP, thereby causing a service failure.

The vulnerability of Modicon microprogrammed controllers lies in the lack of verification of the version of the embedded software updates. Exploiting this vulnerability allows a malicious actor to download an un-supported version of the embedded software via FTP protocol, thereby causing service...

PT-2019-6065

Name of the Vulnerable Software and Affected Versions QNAP Photo Station affected versions not specified Description This issue is related to improper access control, allowing remote attackers to gain unauthorized access to the system. The exploitation of this issue can lead to unauthorized syste...

SUSE-SU-2019:2686-1 Security update for libreoffice

This update for libreoffice fixes the following issues: Updated to version 6.2.7.1. Security issues fixed: - CVE-2019-9854: Fixed unsafe URL assembly flaw bsc1149944. - CVE-2019-9855: Fixed path equivalence handling flaw bsc1149943...

OPENSUSE-SU-2019:2286-1 Security update for lxc

This update for lxc fixes the following issues: Update to lxc 3.2.1. The changelog can be found at https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322 + seccomp: support syscall forwarding to userspace + add lxc.seccomp.allownesting + pidfd: Add initial support for the new pidf...

PT-2019-5209 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.3 Description: The issue is related to an error in the shortcode preview functionality of the WordPress content management system, allowing for XSS attacks. This could potentially enable a remote attacker to...

PT-2019-7062 · WordPress · Wp-Live-Chat-Support

Name of the Vulnerable Software and Affected Versions: wp-live-chat-support plugin versions prior to 4.1.0 Description: The issue concerns JavaScript injections in the wp-live-chat-support plugin for WordPress. Recommendations: For versions prior to 4.1.0, update to version 4.1.0 or later to...

PT-2019-11782 · Jenkins · Jenkins Relution Enterprise Appstore Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Relution Enterprise Appstore Publisher Plugin versions 1.24 and earlier Description: A cross-site request forgery issue allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server. Recommendations: For...

PT-2019-7207 · Apache +2 · Apache Activemq +2

Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ client versions prior to 5.15.5 Description: A remote shutdown command in the ActiveMQConnection class was exposed, allowing an attacker logged into a compromised broker to achieve denial of service on a connected client...

Multiple vulnerabilities in Cybozu Garoon

Overview Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. DOM-based cross-site scripting in the application "Portal" CWE-79 - CVE-2019-5975 Denial-of-service DoS CWE-20 - CVE-2019-5976 Mail header injection in the application "E-mail" CWE-74 - CVE-2019-5977...

PT-2019-16486 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 8.0.16 and prior Description: The issue allows a high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks can result in the unauthorized ability to cause a hang o...

PT-2019-17999 · Lenovo · Lenovo Service Bridge

Name of the Vulnerable Software and Affected Versions: Lenovo Service Bridge versions prior to 4.1.0.1 Description: A vulnerability in Lenovo Service Bridge could allow remote code execution. Recommendations: For versions prior to 4.1.0.1, update to version 4.1.0.1 or later to resolve the issue...

PT-2019-2927

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.9 Description A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled for an externally exposed JSON endpoint and the service has the...

OPENSUSE-SU-2019:1372-1 Security update for sqlite3

This update for sqlite3 to version 3.28.0 fixes the following issues: Security issues fixed: - CVE-2019-9936: Fixed a heap-based buffer over-read, when running fts5 prefix queries inside transaction bsc1130326. - CVE-2019-9937: Fixed a denial of service related to interleaving reads and writes in...

Pre-Installed Software Flaw Exposes Most Dell Computers to Remote Hacking

If you use a Dell computer, then beware — hackers could compromise your system remotely. Bill Demirkapi, a 17-year-old independent security researcher, has discovered a critical remote code execution vulnerability in the Dell SupportAssist utility that comes pre-installed on most Dell computers...

PT-2019-11971 · Grandstream · Grandstream Gwn7610

Name of the Vulnerable Software and Affected Versions: Grandstream GWN7610 versions prior to 1.0.8.18 Description: The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a "/ubus/controller.icc.update nds webroot from tmp" API call,...