CVE-2019-13684

CVE-2019-13684: Chrome prior to 72.0.3626.81 has an inappropriate JavaScript implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (desktop/mobile), version not explicitly stated beyond the pre-72.0.3626.81 range in the pro...

CVE-2019-13683

CVE-2019-13683 affects Google Chrome prior to 77.0.3865.75, where insufficient policy enforcement in developer tools could allow a crafted HTML page to leak cross-origin data. The vulnerability is a cross-origin data disclosure via the browser’s developer tools surface, with network-vector exposu...

A week in security (November 18 – 24)

Last week on Malwarebytes Labs, we looked at stalkerware’s legal enforcement problem, announced our cooperation with other security vendors and advocacy groups to launch Coalition Against Stalkerware, published our fall 2019 review of exploit kits, looked at how Deepfake on LinkedIn makes for...

CVE-2019-3428

The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal in HTTP, resulting in users’ information leakage...

Moderate: Red Hat Security Advisory: ansible security and bug fix update

An update for Ansible is now available for Ansible Engine 2.9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and management system allows a perpetrator to execute arbitrary code or gain access to confidential information.

The vulnerability in the web interface for managing Cisco Prime Infrastructure network equipment is related to insufficient verification of the data entered by users in several sections of the web interface. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or gain...

Unspecified Vulnerability in Open-source Ticket Request System Help Desk (CNVD-2019-42577)

Open-source Ticket Request System OTRS is an open-source defect tracking and management system software from the German OTRS Group. The software categorizes service requests submitted through various channels such as phone, email, etc. into different queues and service levels, and service personn...

Intel Graphics Driver Buffer Overflow Vulnerability

Intel Graphics Driver is the Intel graphics card driver. A buffer overflow vulnerability exists in the kernel mode module in Intel Graphics Driver versions prior to 25.20.100.6618 DCH and 21.20.x.5077. An attacker could exploit this vulnerability to obtain information...

Plugging the Data Leak in Manufacturing

More often than not, when then the internet of things IoT is brought up these days, it conjures images of Alexa, Siri and Cortana. These personal assistants can help users turn on a smart light bulb, flick on the oven and get you the day’s news, all in one fell swoop. However, IoT has evolved far...

U.S. Dept Of Defense: [HTA2] Authorization Bypass on https://██████ leaks confidential aircraft/missile information

Vulnerability description not provided...

CVE-2019-14366

CVE-2019-14366 affects the WordPress WP SlackSync plugin (versions up to 1.8.5). The root cause is leaking a Slack Access Token in the plugin’s source code, enabling an attacker to obtain Slack-relevant information (channels, members, etc.). Publicly available connected sources corroborate the da...

ThreatList: Data Breaches Batter Stock Prices at Public Companies, For Months

Much has been made of the fallout that companies face after a data breach. But for public companies, shaken investor confidence adds a whole new dimension to recovery concerns. A recent study from Comparitech shows that share prices for large breached companies will hit a low point approximately ...

Huge Data Leak Doxes Members of Notorious Neo-Nazi Forum

Apple Mail encryption, Ring doorbell Wi-Fi, and more of the week's top security news...

PHPEMS Online Practice Exam System suffers from XSS vulnerability

PHPEMS PHP Exam Management System online mock exam system based on PHP + Mysql development, support for a variety of types of questions and presentation, is the first to support the question of the question and hand automatic one of the scoring of the PHP online mock exam system. PHPEMS online mo...

Mozilla: Stack buffer overflow in WebRTC networking

A flaw was discovered in Mozilla Firefox and Thunderbird where a fixed-stack buffer overflow could occur during WebRTC signalling. The vulnerability could lead to an exploitable crash or leak data...

chromium-browser: Cross-context information leak

Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Facebook Reveals New Data Leak Incident Affecting Groups' Members

Facebook today revealed yet another security incident admitting that roughly 100 app developers may have improperly accessed its users' data in certain Facebook groups, including their names and profile pictures. In a blog post published Tuesday, Facebook said the app developers that unauthorized...

Facebook Reveals New Data Leak Incident Affecting Groups' Members

Facebook today revealed yet another security incident admitting that roughly 100 app developers may have improperly accessed its users' data in certain Facebook groups, including their names and profile pictures. In a blog post published Tuesday, Facebook said the app developers that unauthorized...

Security update for chromium, re2 (important)

openSUSE Security Update: Security update for chromium, re2 Announcement ID: openSUSE-SU-2019:2425-1 Rating: important References: 1154806 Cross-References: CVE-2019-13699 CVE-2019-13700 CVE-2019-13701 CVE-2019-13702 CVE-2019-13703 CVE-2019-13704 CVE-2019-13705 CVE-2019-13706 CVE-2019-13707...

openSUSE: Security Advisory for chromium, re2 (openSUSE-SU-2019:2420-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...