CVE-2019-0166

Insufficient input validation in the subsystem for IntelR AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable information disclosure via network access...

RubyGem excon Input Validation Error Vulnerability

RubyGem excon is an HTTP server for Ruby applications. A security vulnerability exists in RubyGem excon versions prior to 0.71.0. An attacker can exploit the vulnerability to disclose information...

SonicWall SMA100 Elevation of Privilege Vulnerability

The SonicWall SMA100 is a secure access gateway appliance from SonicWall USA. An information disclosure vulnerability exists in SonicWall SMA100 9.0.0.3 and earlier versions. An attacker can exploit the vulnerability to gain read-only access to unauthorized resources...

PT-2019-15978 · Libspiro · Libspiro

Name of the Vulnerable Software and Affected Versions: Libspiro versions prior to 20190731 Description: The issue is related to a stack-based buffer overflow in the spiro to bpath0 function, located in the spiro.c file. This overflow can potentially lead to an out-of-bounds write. Recommendations...

chromium-browser: Use after free in WebSockets

Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

PT-2019-13755 · Intel · Intel Quartus Prime Pro Edition

Name of the Vulnerable Software and Affected Versions: Intel Quartus Prime Pro Edition versions prior to 19.3 Description: The issue is related to improper permissions in the installer for the License Server software, which may allow an authenticated user to potentially enable escalation of...

Dovecot Null Pointer Dereference Vulnerability

Dovecot is an open source IMAP and POP3 mail server for Linux/Unix. A null pointer dereference vulnerability exists in Dovecot versions prior to 2.3.9.2, which can be exploited by an attacker via a specially crafted email to cause the push notification driver to crash if the push notification...

cfme: rubygem-rubyzip denial of service via crafted ZIP file

A vulnerability in Rubyzip, versions prior to 1.3.0, allows a crafted ZIP file to bypass application checks on ZIP entry sizes. This allows an attacker to spoof data regarding the uncompressed size of the ZIP file, causing a denial of service due to disk consumption. Availability of the system is...

Advantech WebAccess Buffer Overflow Vulnerability (CNVD-2019-45387)

Advantech WebAccess is a set of HMI/SCADA software based on browser architecture from Advantech, Taiwan, China. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A buffer overflow vulnerability exists in...

Apple macOS Catalina CUPS component buffer overflow vulnerability (CNVD-2019-46115)

Apple macOS Catalina is a set of Apple's proprietary operating systems developed specifically for Mac computers.CUPS is one of the open source printing system components for OS X and Unix-like systems. A buffer overflow vulnerability exists in the CUPS component in Apple macOS Catalina versions...

CVE-2019-18377

Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user...

Documize Cross-Site Scripting Vulnerability

Documize is an open source document collaboration system built on Golang and EmberJS. A cross-site scripting vulnerability exists in the domain/section/markdown/markdown.go file in Documize versions prior to 3.5.1. The vulnerability stems from the lack of proper validation of client-side data by...

Unspecified vulnerability in Yachtcontrol

Yachtcontrol is a ship navigation system from the Dutch company Yachtcontrol. A security vulnerability exists in Yachtcontrol versions 2019-10-06 and earlier. An attacker could exploit the vulnerability to execute operating system commands...

Linux kernel memory misreference vulnerability (CNVD-2019-45906)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A memory misreference vulnerability exists in Linux kernel versions prior to 5.2.10. An attacker could exploit this...

PT-2019-12566 · Facebook · Hhvm

Name of the Vulnerable Software and Affected Versions: HHVM versions prior to 3.30.12 HHVM versions 4.0.0 through 4.8.5 HHVM versions 4.9.0 through 4.23.1 HHVM versions 4.24.0 through 4.28.1 Description: The issue is caused by an invalid free in mb detect order, which can lead to application...

WordPress NextGEN Gallery Path Traversal Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.NextGEN Gallery is an image gallery plugin used in it. A path traversal vulnerability exists in path selection in WordPress NextGEN...

PT-2019-15300 · Ge · Relion 670 Series

Name of the Vulnerable Software and Affected Versions: Relion 670 Series versions 1p1r26 through 2.1.0.1 Relion 670 Series versions prior to 1p1r26 Description: An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series outside the intended...

CVE-2019-17404

Nokia IMPACT 18A: allows full path disclosure...

Centreon Web Code Injection Vulnerability

Centreon Web is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . A code injection vulnerability exists in the getStats.php file in versions of Centreon Web prior to...

wolfSSL Authorization Issue Vulnerability

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. An authorization issue vulnerability exists in versions of wolfSSL prior to 3.2.0; no detailed vulnerability details are provided at thi...