hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS)

A flaw was found in the implementation of the "fill buffer", a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer...

Apache Tomcat 9.0.x < 9.0.5 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700705.pasl...

Apache Tomcat 8.0.x < 8.0.50 Security Constraint Weakness

Binary data 700687.pasl...

Apache Tomcat 8.5.x < 8.5.28 Security Constraint Weakness

Binary data 700693.pasl...

Apache Tomcat 9.0.x < 9.0.2 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700704.pasl...

Apache Tomcat 8.0.45 < 8.0.48 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700686.pasl...

Apache Tomcat 7.0.x < 7.0.84 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700676.pasl...

Apache Tomcat 8.5.x < 8.5.34 Open Redirect Weakness

Binary data 700696.pasl...

Apache Tomcat 7.0.x < 7.0.91 Open Redirect Weakness

Binary data 700681.pasl...

Apache Tomcat 9.0.x < 9.0.12 Open Redirect Weakness

Binary data 700709.pasl...

Apache Tomcat 8.5.x < 8.5.24 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700692.pasl...

Schneider Electric Quantum 140NOE771 Network Interface Module Fwupgrade Password Weakness

Binary data 720235.prm...

The vulnerability of the Agent component of the Dr.Web anti-virus protection software, Dr.Web Enterprise Security Suite, allows a hacker to gain access to protected information.

The vulnerability of the Agent component in the Dr.Web anti-virus protection software, Dr.Web Enterprise Security Suite, is related to deficiencies in access control to named communication channels. Exploiting this vulnerability can allow attackers to gain access to information about user...

CVE-2019-1854

A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attack against an affected device. The vulnerability is due to insufficient input validation on the web interface. An attacker could exploit th...

CVE-2019-1692

A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller APIC Software could allow an unauthenticated, remote attacker to access sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms for certa...

Information Disclosure

IBM Java SE is vulnerable to information disclosure. The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the...

Information Disclosure

Java is vulnerable to information disclosure. When generating DSA signatures, the security component in OpenJDK fails to check the digest algorithm strength. The use of a digest weaker than the key strength could lead to the generation of signatures that are weaker than expected and attackers may...

The vulnerability of the InnoDB component of the MySQL Database Server management system, which allows a hacker to cause a service failure.

The vulnerability of the InnoDB component in the MySQL Database Management System is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Code injection

IBM API Connect 2018.1 and 2018.4.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 155078...

Vulnerability of the Server: Optimizer component of the MySQL database management system, which allows a hacker to cause a service failure.

The vulnerability of the Server: Optimizer component of the MySQL database management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the MySQL protocol...