CVE-2019-15718

In systemd 240, busopensystemwatchbindwithdescription in shared/bus-util.c as used by systemd-resolved to connect to the system D-Bus instance, calls sdbussettrusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that...

DEBIAN-CVE-2019-15718

In systemd 240, busopensystemwatchbindwithdescription in shared/bus-util.c as used by systemd-resolved to connect to the system D-Bus instance, calls sdbussettrusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that...

CVE-2019-15718

In systemd 240, busopensystemwatchbindwithdescription in shared/bus-util.c as used by systemd-resolved to connect to the system D-Bus instance, calls sdbussettrusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that...

Ubuntu 18.04 LTS : systemd vulnerability (USN-4120-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4120-1 advisory. It was discovered that the systemd-resolved D-Bus interface did not enforce appropriate access controls. A local unprivileged user could exploit this to modify a...

USN-4120-1 systemd vulnerability

It was discovered that the systemd-resolved D-Bus interface did not enforce appropriate access controls. A local unprivileged user could exploit this to modify a system's DNS resolver settings...

CVE-2019-12754

Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting XSS exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users or potentially bypass access controls such as...

CVE-2019-12754

Technical details about CVE-2019-12754 are not publicly available in the provided connected documents. Monitor for updates.

Bold Page Builder < 2.3.2 - Missing Access Controls

The vulnerability allows any unauthenticated user to perform actions that only an administrator should be allowed to do e.g., modifying settings and importing data...

OpenSSH < 3.6.2 Reverse DNS Lookup Bypass

Binary data 701171.prm...

CVE-2019-11209

The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1;...

Design/Logic Flaw

The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1;...

Information Disclosure

PHP is vulnerable to information disclosure. It has dumpable FPM child processes which allow bypassing opcache access controls because fpmunix.c calls PRSETDUMPABLE prctl...

Google Android Media Framework Component Multiple Security Vulnerabilities

Description Google Android is prone to the following security vulnerabilities: 1. Multiple remote-code execution vulnerabilities 2. Multiple privilege-escalation vulnerabilities 3. Multiple information-disclosure vulnerabilities 4. Multiple denial of service vulnerabilities An attacker can...

Google Android System Component Multiple Security Vulnerabilities

Description Google Android is prone to the following security vulnerabilities: 1. Multiple remote code-execution vulnerabilities. 2. Multiple remote privilege-escalation vulnerabilities. 3. Multiple information-disclosure vulnerabilities. 4. Multiple denial-of-service vulnerability An attacker...

Debian DLA-1891-1 : openldap security update

Several security vulnerabilities were discovered in openldap, a server and tools to provide a standalone directory service. CVE-2019-13057 When the server administrator delegates rootDN database admin privileges for certain databases but wants to maintain isolation e.g., for multi-tenant...

[SECURITY] [DLA 1891-1] openldap security update

Package : openldap Version : 2.4.40+dfsg-1+deb8u5 CVE ID : CVE-2019-13057 CVE-2019-13565 Debian Bug : 932997 932998 Several security vulnerabilities were discovered in openldap, a server and tools to provide a standalone directory service. CVE-2019-13057 When the server administrator delegates...

CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

CVE-2019-7904

Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes...

CVE-2019-7904

CVE-2019-7904 affects Magento versions prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2, where a low-privileged user could make unauthorized environment configuration changes due to insufficient enforcement of user access controls. Public references indicate a security update exists: M...

Security Fundamentals Are Key To Successful Cloud Migration

Earlier I wrote about the importance of patching, or more accurately the importance of transferring the need to patch & the associated risk to someone else by using their cloud security service. While patching definitely falls into the security fundamentals category it remains as relevant as ever...