Amazon Linux 2 : thunderbird (ALAS-2019-1229)

Mozilla: Buffer overflow in WebGL bufferdata on Linux CVE-2019-11693 Mozilla: Use-after-free in XMLHttpRequest CVE-2019-11691 Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulti...

CVE-2019-9880

WPGraphQL 0.2.3 (WordPress) exposes an unauthenticated information-disclosure via the RootQuery for “users,” allowing retrieval of all WordPress users’ email addresses, usernames, and roles. This vulnerability stems from inadequate access controls in the WPGraphQL plugin, enabling an attacker to ...

PT-2019-19913

Name of the Vulnerable Software and Affected Versions: WPGraphQL version 0.2.3 Description: An issue was discovered in the WPGraphQL plugin for WordPress, where an unauthenticated attacker can retrieve all WordPress users' details, including email address, role, and username, by querying the...

Malicious Package

Overview Versions 2.4.3 and 2.4.2 of react-datepicker-plus contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from yo...

Malicious Package

Overview Version 0.2.1 of radicjs contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evalua...

Malicious Package

Overview Version 1.0.3 of libubx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluat...

Malicious Package

Overview Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...

Malicious Package

Overview Version 0.1.2 of github-jquery-widgets contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your...

Malicious Package

Overview Version 1.3.2 of geoheat contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evalua...

Malicious Package

Overview Version 1.0.8 of ember-power-timepicker contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your...

CVE-2019-4048

IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force ID: 156311...

IBM Maximo Asset Management Information Disclosure Vulnerability (CNVD-2019-44945)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. An information...

PT-2019-16862 · Ibm · Ibm Maximo Asset Management

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management version 7.6 Description: The issue allows a physical user of the system to obtain sensitive information from a previous user of the same machine. Recommendations: For IBM Maximo Asset Management version 7.6, at the...

Leaks and breaches: a roundup

It’s time for one of our semi-regular breach/data exposure roundup blogs, as the last few days have brought us a few monsters. If you use any of the below sites, or if you think some of your data has been sitting around exposed, we’ll hopefully give you a better idea of what the issue is. Seeing ...

[SECURITY] Fedora 30 Update: drupal7-ds-2.16-1.fc30

Display Suite allows you to take full control over how your content is disp layed using a drag and drop interface. Arrange your nodes, views, comments, user data etc. the way you want without having to work your way through dozens of tem plate files. A predefined list of layouts D7 only is...

The vulnerability of the User Data Services (UDS) software interface of the Cisco Unified Communications Manager (Unified CM) platform allows a perpetrator to trigger a service failure.

The vulnerability of the User Data Services UDS software interface of the Cisco Unified Communications Manager Unified CM platform is related to insufficient validation of entered data. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending specially...

Google Is Finally Making Chrome Extensions More Secure

Third-party developers don't always build extensions with security best practices in mind. Now Google is taking steps to better protect user data...

News aggregator app Flipboard hacked; user data stolen

By Uzair Amir Hackers managed to breach Flipboard’s security for sensitive database multiple times putting millions of users at risk. Just yesterday, it was reported that the online graphic-design tool website Canva had suffered a massive data breach in which a hacker stole over 139 million...

Unauthorized Access Vulnerability in Collaborative Office System of Yunnan Ruoshui Network Technology Co.

Yunnan Ruoshui Network Technology Co., Ltd. is an Internet service company. An unauthorized access vulnerability exists in the collaborative office system of Yunnan Ruoshui Network Technology Co. An attacker can obtain sensitive information of website users by brute force cracking...

EUVD-2019-0473

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...