The vulnerability of the setusercontext() function in the doas utility allows a attacker to compromise the integrity, confidentiality, and accessibility of the protected information.

The vulnerability of the setusercontext function in the doas utility exists due to insufficient validation of input data. Exploiting this vulnerability could allow a remote attacker to compromise the integrity, confidentiality, and accessibility of the protected information...

The vulnerability of the recv_files and read_ndx_and attrs functions in the rsync daemon allows a hacker to circumvent existing access restrictions and compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of rsync exists due to the lack of checks on the filenames fnamecmp in the daemonfilterlist data structure in the recvfiles function in receiver.c, and the absence of a sanitizepaths mechanism for paths found in the “xname follows” strings in the readndxand attrs function in...

CVE-2019-19530

A use-after-free flaw was found in the acmprobe USB subsystem in the Linux kernel. A race condition occurs when a destroy procedure is initiated allowing the refcount to decrement on the interface so early that it is never under counted. A malicious USB device is required for exploit. System...

The security vulnerabilities of Firefox browsers, Firefox ESR, and the Thunderbird email client allow attackers to induce a service failure and compromise data integrity.

The security vulnerabilities of Firefox, Firefox ESR, and the email client Thunderbird are related to the execution of operations outside of the buffer data area. Exploiting these vulnerabilities can allow a malicious actor to cause service failures and compromise data integrity...

CVE-2019-19578

A flaw was found in Xen in versions through 4.12.x. An incorrect fix for CVE-2017-15595 allows x86 PV guest OS users to cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2019-14899

A flaw was found in openvpn. A malicous access point or adjacent user can determine if a connected user is using a VPN by making positive inferences about the websites they are visiting, and determining the correct sequence and acknowledgement numbers in use, which allows the attacker to inject...

PT-2020-5627 · Qemu +6 · Qemu +6

Name of the Vulnerable Software and Affected Versions: QEMU versions 4.0 through 4.1.0 Description: The issue is related to the rom copy function in hw/core/loader.c, which does not properly validate the relationship between two addresses. This allows attackers to trigger an invalid memory copy...

PT-2019-5023

Name of the Vulnerable Software and Affected Versions Git versions prior to 2.24.1 Git versions prior to 2.23.1 Git versions prior to 2.22.2 Git versions prior to 2.21.1 Git versions prior to 2.20.2 Git versions prior to 2.19.3 Git versions prior to 2.18.2 Git versions prior to 2.17.3 Git version...

PT-2019-5230 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.33.1 Description: The issue allows attackers to bypass the Title blacklist protection mechanism. This can be achieved by starting with an arbitrary title, establishing a non-resolvable redirect for the associated...

OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

The vulnerability of Skia, a graphics engine used by Google Chrome, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Skia graphics engine in Google Chrome browsers is related to writing beyond the buffer limits of the memory buffer. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information throu...

The vulnerability of the RouterOS operating system, which arises due to insufficient validation of input data, allows a hacker to cause damage to the integrity of DNS system data.

The vulnerability of the RouterOS operating system exists due to insufficient checks on input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause damage to the integrity of DNS system data...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to compromise data integrity, gain unauthorized access to protected information, and cause service failures.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to compromise data integrity, gain unauthorized access to protected information, and cause service failures throug...

UBUNTU-CVE-2019-14901

A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability ...

The vulnerability of the jQuery.extend function (true, {}, …) in the jQuery library allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the jQuery.extend function exists because measures to protect the structure of web pages are not taken. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality and integrity of the protected information...

CVE-2019-10172

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity XXE vulnerability affects codehaus's jackson-mapper-asl libraries. This vulnerability is similar to CVE-2016-3720. The primary threat from this flaw is data integrity...

The vulnerability of the FortiOS operating system, the FortiAnalyzer network firewall, and the FortiManager centralized management system lies in the lack of mechanisms for checking certificate revocation. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of the FortiOS operating system, FortiAnalyzer network firewall, and FortiManager centralized management system are related to the lack of verification for certificate revocation. Exploiting these vulnerabilities allows a malicious actor to compromise the confidentiality,...

PT-2019-5307

Name of the Vulnerable Software and Affected Versions org.codehaus.jackson:jackson-mapper-asl versions 1.9.x Description A flaw was found in the org.codehaus.jackson:jackson-mapper-asl library, related to incorrect restriction of XML external entity references. This issue is similar to previously...

CVE-2019-18683

A flaw was found in the Linux kernel. Multiple race conditions were found in the vivid driver leading to privilege escalation and in at least one case a use-after-free condition. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2019-17340

A flaw was found in xen. When the code processing grant table transfer requests finds a page with an address too large to be represented in the interface with the guest, it allocates a replacement page and copies page contents. The page as well as certain other remnants of an affected guest will ...