About the security content of macOS High Sierra 10.13 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

IoT Company Wyze Leaks Emails, Device Data of 2.4M

An exposed Elasticsearch database, owned by Internet of Things IoT company Wyze, was discovered leaking connected device information and emails of millions of customers. Wyze makes smart home cameras and connected devices like connected bulbs and plugs, which can be integrated with smart home...

Apple iOS and Apple macOS Mojave Feedback Assistant Component Competition Condition Vulnerability

Apple iOS and Apple macOS Mojave are both products of Apple Inc. Apple iOS is an operating system for mobile devices. apple macOS Mojave is a specialized operating system for Mac computers. feedback Assistant is one of the Feedback Assistant is one of the system error feedback components. A...

Security Bulletin: Vulnerability affects IBM Watson Assistant for IBM Cloud Pak for Data

Summary DOM-based vulnerability affects IBM Watson TM Assistant for IBM Cloud Pak for Data. A DOM-based, cross-site scripting vulnerability was found in the admin console where user input was not validated correctly. An authenticated user could exploit the flaw by injecting JavaScript code into t...

CVE-2019-4428

IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2019-4428

IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Cross site scripting

IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2019-4428

IBM Watson Assistant for IBM Cloud Pak for Data versions 1.0.0–1.3.0 are affected by a DOM-based cross-site scripting vulnerability in the admin console, where unsanitized user input can store and execute JavaScript in the browser, potentially exposing credentials within a trusted session. The is...

CVE-2019-4428

IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

News Wrap: Voice Assistant Laser Hack, Twitter Insider Threats, Data Breach Fine Fails

Threatpost editors break down the top news stories for the week ended Nov. 8. The hot stories of the week include: Despite trillions of dollars in data-breach fine payouts, each year the number of compromised companies and individuals with private data exposed rise – a Threatpost feature looks at...

Unspecified Vulnerability in Apple iOS and iPadOS Setup Assistant Component

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for iPad tablets.Setup Assistant is one of the Setup Assistant components. A security vulnerability in the Setup Assistant component in Appl...

Hackers Can Use Lasers to ‘Speak’ to Your Amazon Echo or Google Home

By sending laser-powered “light commands” to a smart assistant, researchers could force it to unlock cars, open garage doors, and more...

The vulnerability of the Windows Update Assistant’s update handling mechanism, related to insecure privilege management, allows a malicious actor to execute arbitrary code.

The vulnerability of the Windows Update Assistant’s update handling is related to insecure management of privileges. Exploiting this vulnerability allows an attacker to execute arbitrary code with elevated privileges...

Android Security Bulletin—November 2019Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2019-11-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Exploit for CVE-2019-6329

Local Privilege Escalation in HP Support Assistant A local pri...

CVE-2019-1378

An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows 10 Update Assistant Elevation of Privilege Vulnerability'...

Privilege escalation

An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows 10 Update Assistant Elevation of Privilege Vulnerability'...

CVE-2019-1378

An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows 10 Update Assistant Elevation of Privilege Vulnerability'...

CVE-2019-1378

CVE-2019-1378 is a local privilege escalation affecting Windows 10 Update Assistant. The vulnerability arises from how permissions are handled in the Update Assistant, allowing a locally authenticated attacker to elevate to SYSTEM and run arbitrary code. Microsoft’s advisory notes that the fix in...

Greenbone Security Assistant (GSA) < 7.0.3 Host Header Injection Vulnerability - Active Check

Greenbone Security Assistant GSA is prone to an HTTP host header injection vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...