libX11: Off-by-one error in XListExtensions in ListExt.c

An off-by-one error has been discovered in libX11 in functions XGetFontPath, XListExtensions, and XListFonts. An attacker who can either configure a malicious X server or modify the data coming from one could use this flaw to make the program crash or have other unspecified effects, caused by the...

Moderate: Red Hat Security Advisory: Xorg security and bug fix update

An update for Xorg is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Low: Red Hat Security Advisory: kde-workspace security and bug fix update

An update for kde-workspace, kde-settings, kdelibs, kmag, and virtuoso-opensource is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

July 9, 2019—KB4507448 (Monthly Rollup)

None None...

July 9, 2019—KB4507458 (OS Build 10240.18275)

None None...

The vulnerability of the eDocLib platform for storing and processing corporate data arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out cross-site scripting attacks.

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser during the opening of the access...

CVE-2019-11711

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did...

DEBIAN-CVE-2019-11711

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did...

CVE-2019-11716

Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNameswindow. Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes t...

Design/Logic Flaw

Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNameswindow. Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes t...

CVE-2019-11716

Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNameswindow. Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes t...

July 22, 2019—KB4505658 (OS Build 17763.652)

None None...

The vulnerability of the Window Filtering Platform driver SNPAVdrv in the Secret Net Studio information protection system allows a hacker to execute arbitrary code in kernel mode.

The vulnerability of the Window Filtering Platform driver SNPAVdrv in the Secret Net Studio information protection system is related to the lack of proper checks on the input buffer. Exploiting this vulnerability allows an attacker to execute arbitrary code in kernel mode...

Mozilla: Script injection within domain through inner window reuse

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did...

July 16, 2019—KB4507463 (Preview of Monthly Rollup)

None None...

July 16, 2019—KB4507467 (OS Build 15063.1955)

None None...

July 16, 2019—KB4507465 (OS Build 16299.1296 )

None None...

Mozilla: Script injection within domain through inner window reuse

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did...

Mozilla: Script injection within domain through inner window reuse

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did...

Mozilla: Script injection within domain through inner window reuse

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did...