PT-2019-11592 · Red Hat +1 · Spacewalk +1

Name of the Vulnerable Software and Affected Versions: Spacewalk versions prior to 2.10 Description: The issue arises from the unsafe computation of client token checksums. An attacker with a valid but expired authenticated set of headers could manipulate the session validity without altering the...

PT-2019-11617 · Yard +3 · Yard +3

Name of the Vulnerable Software and Affected Versions: yard versions prior to 0.9.20 Description: A path traversal issue was discovered in yard when using yard server to serve documentation, allowing unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under...

Google Chrome Fake Address Bar Content Vulnerability

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 68.0.3440.75, which stems from the program failing to adequately validate data. A remote attacker can exploit the vulnerability to spoof the contents of the Omnibox...

Magento cross-site scripting vulnerability (CNVD-2019-26223)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . A cross-site scripting vulnerability exists in Magento Open Source versions prior to 1.9.4.2 and Magento Commerc...

UBUNTU-CVE-2018-6145

Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

Intel Chipset Device Software Elevation of Privilege Vulnerability

Intel Chipset Device Software is a chipset firmware update utility from Intel Corporation USA. A security vulnerability exists in the installer in Intel Chipset Device Software INF Update Utility versions prior to 10.1.1.45. A local attacker can exploit the vulnerability to elevate privileges...

MSC800 affected by hard-coded credentials vulnerability

The ICS-CERT reported a security vulnerability that affects MSC800 versions before 4.0. The MSC800 uses hard-coded credentials, which potentially allow low-skilled remote attackers to reconfigure settings and /or disrupt the functionality of the device. Currently SICK is not aware of any public...

DEBIAN-CVE-2019-10155

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects...

CloudBees Jenkins ElectricFlow Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . ElectricFlow Plugin is used in one of the...

Twisted Input Validation Error Vulnerability

Twisted is an event-driven open source web engine written in the Python language. An input validation error vulnerability exists in Twisted versions prior to 19.2.1. The vulnerability stems from a network system or product that does not properly validate incoming data. An attacker can exploit the...

Google Chrome Swiftshader Buffer Overflow Vulnerability (CNVD-2019-17139)

Google Chrome is a web browser of Google Google.Swiftshader is one of the open source 3D rendering tool. An out-of-bounds read vulnerability exists in Swiftshader in versions of Google Chrome prior to 75.0.3770.80. The vulnerability stems from a web-based system or product performing operations i...

CVE-2019-3955

Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly validating RsaPubKeyLen during key negotiation. An unauthenticated remote attacker can cause a heap buffer overflow by specifying a large RsaPubKeyLen, which cou...

CVE-2019-11960

A remote code execution vulnerability was identified in HPE Intelligent Management Center IMC PLAT earlier than version 7.3 E0506P09...

CVE-2019-5375

A remote code execution vulnerability was identified in HPE Intelligent Management Center IMC PLAT earlier than version 7.3 E0506P09...

CVE-2019-5352

A remote code execution vulnerability was identified in HPE Intelligent Management Center IMC PLAT earlier than version 7.3 E0506P09...

CVE-2019-5357

A remote code execution vulnerability was identified in HPE Intelligent Management Center IMC PLAT earlier than version 7.3 E0506P09...

Quest Software Kace K1000 Appliance Cross-Site Scripting Vulnerability

Quest Software Kace K1000 Appliance is a system management appliance from Quest Software, USA. The product is used for software license management, patch and endpoint security management, software distribution and server monitoring functions. A cross-site scripting vulnerability exists in Quest...

CVE-2018-5404

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges 'User Console Only' role to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. A...

ProjectSend cross-site scripting vulnerability (CNVD-2019-36883)

ProjectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A cross-site scripting vulnerability exists in the 'Name' field of the My Account page in versions prior to ProjectSend r1053. The vulnerability stems from the WEB application's lack of proper...

Mozilla Firefox ESR Security Advisories (MFSA2019-09, MFSA2019-14) - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...