freeradius: eap-pwd: authentication bypass via an invalid curve attack

A vulnerability was found in FreeRadius. An invalid curve attack allows an attacker to authenticate as any user, without knowing the password. FreeRADIUS doesn't verify whether the received elliptic curve point is valid. The highest threat from this vulnerability is to data confidentiality and...

Security Bulletin: Rational Functional Tester Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Summary Java API Documentation contains a frame injection vulnerability. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with your IBM ID ---|--- CVEID: CVE-2013-1571...

The vulnerability in the IBM SDK development tools arises from an incorrect limitation on the path name to the restricted access catalog. This allows attackers to compromise the integrity of the protected information.

The vulnerability of the IBM SDK development tools exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the integrity of protected information during the extraction o...

The vulnerability of the urllib module in the Python programming language, related to deficiencies in pathname restrictions, allows attackers to gain access to confidential data and compromise its integrity.

The vulnerability of the urllib module in the Python programming language is related to errors in input validation. Exploiting this vulnerability allows an attacker to gain access to confidential data and compromise its integrity...

The vulnerability of the software platform for integrating Spring Integration corporate applications lies in improper restrictions on XML references to external objects. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the software platform for integrating Spring Integration corporate applications is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility o...

The vulnerability of Junos OS’ firewall filter configuration allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of Junos OS’ firewall filter configuration is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

The vulnerability of the libcurl library, caused by buffer overflows in the stack, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Curlauthcreatentlmtype3message function, which creates the NTLM type-3 header lib/vauth/ntlm.c, from the libcurl library, is due to a buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

A vulnerability in the PHP programming language interpreter, related to reading beyond the buffer boundaries of dynamic memory, allows attackers to cause service failures, violate confidentiality, and compromise the integrity of protected data.

The vulnerability in the PHP programming language interpreter relates to reading beyond the buffer boundaries during the processing of regular expressions. Exploiting this vulnerability can allow a malicious actor to cause service failures, violate the confidentiality and integrity of protected...

The vulnerability of the IonMonkey JavaScript compiler for Firefox and Firefox ESR browsers lies in a type conversion error, which allows attackers to compromise the integrity of protected data.

The vulnerability of the IonMonkey compiler for Firefox and Firefox ESR browsers lies in a type conversion error when accessing arbitrary objects during compilation. Exploiting this vulnerability allows an attacker to compromise the integrity of protected data locally...

The vulnerability of the wget console program for downloading files over the network is related to the UNIX utility commands in the BusyBox. This vulnerability stems from the operation of writing data beyond the buffer limit into dynamic memory, allowing an attacker to compromise the integrity and accessibility of data, as well as to cause service failures.

The vulnerability of the wget console program for downloading files over the network is related to a buffer overflow vulnerability in dynamic memory. Exploiting this vulnerability allows an attacker to compromise the integrity and accessibility of data, as well as to cause service interruptions...

The vulnerability of the mod_session module in the Apache HTTP Server, related to the lack of consideration for the lifetime of a session, allows attackers to compromise the integrity of protected data.

The vulnerability of the modsession module in the Apache HTTP Server is related to the lack of time-out checking before session data is decoded. Exploiting this vulnerability allows an attacker to compromise the integrity of protected data...

The vulnerability of the coTURN server, related to configuration errors, allows attackers to compromise data integrity.

The vulnerability of the coTURN server is related to a configuration error that causes external traffic to be redirected to the backend interface of its own host. Exploiting this vulnerability allows an attacker to compromise the integrity of data...

CVE-2019-2424

Vulnerability in the Oracle Retail Convenience Store Back Office component of Oracle Retail Applications subcomponent: Level 3 Maintenance Functions. The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

Code injection

Vulnerability in the Oracle Service Contracts component of Oracle E-Business Suite subcomponent: Renewals. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

Buffer overflow

Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware subcomponent: Outside In Filters. Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2019-2706

Vulnerability in the Oracle Business Process Management Suite component of Oracle Fusion Middleware subcomponent: BPM Foundation Services. The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2019-2719

CVE-2019-2719 affects Oracle Siebel CRM Knowledge component (InfoCenter/Web Applications). Affected: 8.5.1.0–8.5.1.7, 8.6.0, 8.6.1. An unauthenticated attacker can exploit via HTTP; attacks require user interaction and may lead to unauthorized update/insert/delete and read access of Oracle Knowle...

CVE-2019-2660

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite subcomponent: Setup, Admin. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker wi...

edk2: Buffer Overflow in BlockIo service for RAM disk

A flaw was found in edk2. When registering a RAM disk whose size is not a multiple of 512 bytes, the BlockIo protocol produced by the RamDiskDxe driver will incur memory read/write overrun. The memory overrun will happen when reading/writing the last block on the RAM disk. The highest threat from...

The vulnerability in the setup of Azure DevOps Server and Team Foundation Server, a system for project management and version control, exists due to the lack of protective measures for the website structure. This allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Azure DevOps Server and Team Foundation Server project management and version control systems exists due to the lack of protective measures for the website structure. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integri...