PT-2019-6144 · Unknown +9 · Squashfs-Tools +9

Name of the Vulnerable Software and Affected Versions: Squashfs-Tools version 4.5 Description: The issue is related to the squashfs opendir function in the unsquash-2.c component of Squashfs-Tools, which incorrectly handles symbolic links before accessing a file. This allows a remote attacker to...

CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

Design/Logic Flaw

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

CVE-2019-16174: Improper Restriction of XML External Entity Reference

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity...

Implementing EQR — Creating a Solution for Real-Time Processing of Disparate Big Data Sources

Building an Event Query Router for Big Data Translation and Processing In a previous post, we discussed the data engineering challenge of scaling security. Analyzing the volume and variety of data required by a cybersecurity application isn’t an easy process, so we are always looking for innovati...

kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction

A flaw was found in the KDE Frameworks KConfig prior to version 5.61.0. Certain syntax commands were allowed in .desktop, .directory, and configuration files to allow flexible configurations with the desktop environment. An attacker could add malicious code to a file that a user would...

PT-2019-4827

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 60.9 Firefox ESR versions prior to 68.1 Firefox versions prior to 69 Description The issue allows an attacker to escape the sandbox of a compromised Firefox browser by loading accounts.firefox.com and forcing a...

CVE-2019-5611

In FreeBSD 12.0-STABLE before r350828, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r350829, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, a missing check in the function to arrange data in a chain of mbufs could cause data returned not to be contiguou...

PT-2019-6205 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.2 and later Description: The issue is related to improper validation of invited users' email addresses, allowing projects to add members with email address domains that should be blocked by group settings. This can be...

The vulnerability of the onSubmit() method of the Horde_Form_Type_image class (Horde/Form/Type.php) in the php-horde-form functionality allows a attacker to compromise data integrity, gain access to confidential data, and cause service interruptions.

The vulnerability of the onSubmit method in the HordeFormTypeimage class Horde/Form/Type.php of the php-horde-form functionality package is related to incorrect elimination of special characters in the POST parameter. This can lead to incorrect restrictions on the path to a restricted directory...

The vulnerability of the DOSBox emulator, related to the execution of operations beyond the buffer boundaries in memory, allows a perpetrator to compromise data integrity, gain access to confidential information, and cause service failures.

The vulnerability of the DOSBox emulator is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to compromise data integrity, gain access to confidential information, and cause service failures...

The vulnerability of the CalDAV function in the httpd daemon of the Cyrus IMAP server allows attackers to compromise data integrity, gain access to confidential information, cause service failures, and execute arbitrary code.

The vulnerability of the CalDAV function in the httpd daemon of the Cyrus IMAP server is related to the issue of writing operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to compromise data integrity, gain access to confidential information, cause...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows attackers to compromise data integrity, gain access to confidential information, and cause service failures.

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis is related to the blocking of the polymorphic deserialization in the jboss-common-core class. Exploiting this vulnerability could allow an attacker to compromise data integrity, gain...

The vulnerability of the Evolution email program, related to the improper verification of the OpenPGP cryptographic signature, allows a hacker to compromise the integrity of the data.

The vulnerability of the Evolution email program is related to an improper verification of the OpenPGP cryptographic signature. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of data...

CVE-2019-14744

A flaw was found in the KDE Frameworks KConfig prior to version 5.61.0. Certain syntax commands were allowed in .desktop, .directory, and configuration files to allow flexible configurations with the desktop environment. An attacker could add malicious code to a file that a user would...

Oracle Linux 8 : pacemaker (ELSA-2019-1279)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1279 advisory. - Improve clients' authentication of IPC servers CVE-2018-16877 - Fix use-after-free with potential information disclosure CVE-2019-3885 - Improve...

The vulnerability of UEFI (BIOS) software on HP workstations allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of UEFI BIOS software on HP workstations is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information, provided that the TPM module is disabled...

The vulnerability of Microprogrammed Software in HP Color LaserJet Pro and HP LaserJet Pro printers stems from the lack of measures taken to protect the structure of web pages. This allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of HP Color LaserJet Pro and HP LaserJet Pro printer software exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality and integrity of the protected information...