UBUNTU-CVE-2019-15790

Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs to by reading /proc/pid through getpidinfo in data/apport. An unprivileged user could exploit this to read information about a privileged...

Security Bulletin: IBM Maximo Health, Safety, and Environment Manager Installation Gives Application Access to Non-Authorized Users (CVE-2019-4546)

Summary After installing the Health, Safety, and Environmental add-on to IBM Maximo Asset Management, a user is granted additional privileges that they are not normally allowed to access. Vulnerability Details CVEID: CVE-2019-4546 DESCRIPTION: After installing the Health, Safety, and Environmenta...

Unspecified Vulnerability in GNU Guix

GNU Guix is an open source, cross-platform package manager from the GNU Project. A security vulnerability in GNU Guix version 1.0.1, which stems from the parent directory of the user profile directory being globally writable, can be exploited by a local attacker to gain access to arbitrary users...

U.S. Dept Of Defense: [HTA2] Receiving████ access request on @wearehackerone.com email address

Hi, Description I'm not exactly sure what happened, but it seems that my researcher email [email protected] has been added in a group that receives new user access request from MIDRP. ████████ ██████████ Steps to reproduce I'm honestly not sure what happened. I did test a few .███...

Cisco Small Business Smart and Managed Switches CVE-2019-12718 Cross Site Scripting Vulnerability

Description Cisco Small Business Smart and Managed Switches are prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of th...

Cisco Expressway Series and Telepresence VCS CVE-2019-12705 Cross Site Scripting Vulnerability

Description Cisco Expressway Series and Telepresence Video Communication Server VCS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting us...

CVE-2019-14832

CVE-2019-14832 affects Keycloak REST API prior to 8.0.0, allowing an authenticated attacker who knows a user id to access information across realms the user is not configured for, i.e., a cross-realm user access/authorization bypass. Concrete details from connected docs confirm the vulnerability ...

TYPO3 freeCap CAPTCHA Extension CVE-2019-16699 Remote Code Execution Vulnerability

Description TYPO3 freeCap CAPTCHA extension is prone to a remote code-execution vulnerability. A remote attacker can leverage this issue to execute arbitrary code within the context of the application. Successful exploits will compromise the application and possibly the underlying system. Version...

keycloak: cross-realm user access auth bypass

A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks...

keycloak: cross-realm user access auth bypass

A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks...

Redhat Wildfly Core CVE-2019-14838 Privilege Escalation Vulnerability

Description Redhat Wildfly is prone to a privilege-escalation. A remote attacker can exploit this issue to gain elevated privileges on an affected device. Technologies Affected Redhat JBoss Data Grid 7 Redhat JBoss Enterprise Application Platform 7.0 Redhat Single Sign-On 7.0 Redhat WildFly Core...

About the security content of iCloud for Windows 7.5 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

SAP BusinessObjects Business Intelligence Platform Multiple Cross Site Scripting Vulnerabilities

Description SAP BusinessObjects Business Intelligence Platform is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. Remote attackers can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in...

TIBCO MDM CVE-2019-11212 Multiple Unspecified Cross-Site Scripting Vulnerabilities

Description TIBCO MDM is prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site...

Microsoft Windows MS XML CVE-2019-1060 Remote Code Execution Vulnerability

Description Microsoft Windows MS XML is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the current user. Failed exploit attempts may result in a denial of service condition. Technologies Affected Microsoft Windows 10...

Microsoft Windows Remote Desktop Protocol CVE-2019-1326 Denial of Service Vulnerability

Description Microsoft Windows Remote Desktop Protocol is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause the target service to stop responding, denying service to legitimate users. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems...

Microsoft Windows JET Database Engine CVE-2019-1359 Remote Code Execution Vulnerability

Description Microsoft Windows JET Database Engine is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of an affected system. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10...

Cisco Prime Infrastructure CVE-2019-12712 Cross Site Scripting Vulnerability

Description Cisco Prime Infrastructure is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

CVE-2019-17053

CVE-2019-17053 affects the Linux kernel's ieee802154_create in net/ieee802154/socket.c (AF_IEEE802154) up to version 5.3.2, where CAP_NET_RAW is not enforced. This allows unprivileged users to create a raw socket (local, low complexity). The connected documents reiterate the same description but ...

Ruby Multiple Security Vulnerabilities

Description Ruby is prone to the following security vulnerabilities: 1. An authorization-bypass vulnerability 2. A denial-of-service vulnerability 3. An HTTP response-splitting vulnerability 4. A command-injection vulnerability An attacker can exploit these issues to bypass certain security...