PT-2019-11695 · Jenkins · Jenkins Kmap Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Kmap Plugin affected versions not specified Description: A missing permission check in the KmapJenkinsBuilder.DescriptorImpl form validation methods of the Jenkins Kmap Plugin allows attackers with Overall/Read permission to initiate ...

PT-2019-11381 · Jenkins · Jenkins Soasta Cloudtest Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SOASTA CloudTest Plugin affected versions not specified Description: A missing permission check in the CloudTestServer.DescriptorImpldoValidate form validation method allows attackers with Overall/Read permission to initiate a...

Mobile-First Phishing Kit Targets Verizon Customers

As people increasingly go mobile-first in their work and personal lives, cybercrime is keeping up: The latest is a phishing kit that specifically targets Verizon Wireless customers in the U.S. According to Jeremy Richards, a researcher at Lookout Security, the kit pushes phishing links to users v...

EulerOS 2.0 SP5 : python (EulerOS-SA-2019-1149)

According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding with an incorrect netloc during NFKC...

Google Warns of Growing Android Attack Vector: Backdoored SDKs and Pre-Installed Apps

Google is reporting an uptick in efforts by bad actors to plant potentially harmful applications PHAs on Android devices via pre-installed apps and by bundling them with system updates delivered over the air. The technique is especially troubling, Google said, because PHAs are often malicious and...

CVE-2018-19392

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password including the default "admin" account, without prior knowledge of their password. All that is required is knowledge of the...

Design/Logic Flaw

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password including the default "admin" account, without prior knowledge of their password. All that is required is knowledge of the...

SAP J2EE Engine Cross-Site Scripting Vulnerability (CNVD-2019-07213)

SAP J2EE Engine is a set of runtime environments for J2EE applications. A cross-site scripting vulnerability exists in SAP J2EE Engine. An attacker can exploit the vulnerability to conduct a cross-site scripting attack...

Unpatched Windows Bug Allows Attackers to Spoof Security Dialog Boxes

A previously unknown bug in Microsoft Windows would allow an attacker to spoof Windows dialog boxes that surface when making changes to the Windows registry. This would allow an adversary to plant malware or make other nefarious changes in the registry while getting around Windows’ built-in...

Information disclosure

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding with an incorrect netloc during NFKC normalization. The impact is: Information disclosure credentials, cookies, etc. that are cached against a given hostname. The components are:...

CVE-2018-19636

Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges...

Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability

A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters...

GnuTLS RSA Decryption Information Disclosure

The vulnerability of the GnuTLS cryptographic library is related to an error in the verification of decrypted RSA data. Exploiting this vulnerability could allow an attacker to gain access to protected information by using a secondary cache channel...

Linux kernel DoS

The vulnerability of the Linux operating system’s kernel is caused by a buffer overflow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2019-8341

An issue was discovered in Jinja2 2.10. The fromstring function is prone to Server Side Template Injection SSTI where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with INJECTION COMMANDS in a URI. NOTE: The maintainer and...

Multiple Lexmark Product Input Validation Vulnerabilities

Lexmark is an American developer and manufacturer of printers. An input validation vulnerability exists in multiple Lexmark products, which could be exploited by an attacker to perform a delete operation...

CVE-2019-7740

An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code core.js writeDynaList could lead to an XSS attack vector...

Microsoft Edge Memory Corruption Vulnerability

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the...

CVE-2018-3991

An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, version 6.40.2402.500. A specially crafted TCP packet can cause a heap overflow, potentially leading to remote code execution. An attacker can send a malformed TCP packet to trigg...

CVE-2017-1177

CVE-2017-1177 affects IBM BigFix Compliance 1.7–1.9.91, disclosing sensitive information to unauthorized users. Reported as a medium-severity issue (CVSS v2 base 5.0; CVSS v3 base 5.3) with network vector and no user interaction required. The material notes potential to mount further attacks usin...