CVE-2019-16144

An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield during API calls...

SUSE-SU-2019:14146-1 Security update for libvirt and libvirt-python

This update for libvirt and libvirt-python fixes the following issues: libvirt: - CVE-2016-10746: Fixed an authentication bypass where a guest agent with a read only connection could call virDomainGetTime API calls bsc1133150. - rpc: increase the size of REMOTEMIGRATECOOKIEMAX bsc1134783...

Improper access control

An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially...

CVE-2018-20904

cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction SEC-427...

CVE-2018-20905

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction SEC-429...

CVE-2018-20904

cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction SEC-427...

Security feature bypass

cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction SEC-427...

Information disclosure

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction SEC-430...

Design/Logic Flaw

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction SEC-429...

CVE-2018-20906

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction SEC-430...

CVE-2018-20906

CVE-2018-20906 affects cPanel before 71.9980.37. The issue allows attackers to make API calls that bypass the images feature restriction (SEC-430). The connected documents confirm the product (cPanel), affected version range (before 71.9980.37), and the described impact (bypassing images feature ...

CVE-2018-20905

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction SEC-429...

CVE-2018-20906: Incorrect Permission Assignment for Critical Resource

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction SEC-430...

CVE-2018-20905: Incorrect Permission Assignment for Critical Resource

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction SEC-429...

CVE-2019-13338

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

Ubuntu: Security Advisory (USN-4047-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-13338: Missing Authentication for Critical Function

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

Ubuntu 16.04 LTS / 18.04 LTS : libvirt vulnerabilities (USN-4047-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4047-1 advisory. Matthias Gerstner and Jn Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to...

USN-4047-1: libvirt vulnerabilities

Matthias Gerstner and Ján Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to check for arbitrary files, or execute arbitrary binaries. In the default installation, attackers would be isolated by the libvirt AppArmor profile...

RATs and stealers rush through “Heaven’s Gate” with new loader

By Holger Unterbrink and Edmund Brumaghin. Executive summary Malware is constantly finding new ways to avoid detection. This doesn't mean that some will never be detected, but it does allow adversaries to increase the period of time between initial release and detection. Flying under the radar fo...