The vulnerability of HP Color LaserJet Pro printer microprogramming software, related to the falsification of inter-site requests, allows a perpetrator to compromise the confidentiality and integrity of protected information.

The vulnerability of HP Color LaserJet Pro printer microprogramming software is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

PT-2019-2566 · Abb · Abb Idal Ftp Server

Name of the Vulnerable Software and Affected Versions: ABB IDAL FTP server affected versions not specified Description: The issue allows an authenticated attacker to traverse to arbitrary directories on the hard disk using the CWD ../ command and then use the FTP server functionality to download...

libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter

A flaw was found in libvirt in version 4.1.0 and earlier. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons. The highest threat from this...

rubygems: Installing a malicious gem may lead to arbitrary code execution

A flaw was found in RubyGems. A crafted gem with a multi-line name is not handled correctly allowing an attacker to inject arbitrary code to the stub line of gemspec. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

PT-2019-3290

Name of the Vulnerable Software and Affected Versions VideoLAN VLC media player versions 3.x through 3.0.7 Description The issue is related to the Matroska demuxer in the VideoLAN VLC media player, which has a double free error when parsing a malformed MKV file type. This can be exploited by a...

PT-2019-2931 · Dosbox +3 · Dosbox +3

Name of the Vulnerable Software and Affected Versions: DOSBox versions 0.74-2 Description: The issue is related to insufficient access control in the emulator. Exploitation of this issue may allow a remote attacker to impact data integrity, gain access to confidential data, and cause a denial of...

PT-2019-3449

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.30.0 through 1.32.1 Description The issue is related to the possibility of loading user JavaScript from a non-existent account, which allows anyone to create the account and perform cross-site scripting XSS on users loadin...

The vulnerability of the EAP Server component of the EAP-PWD certification protocol for wireless communication devices with WPA encryption lies in the improper use of privileges, allowing attackers to compromise data integrity and confidentiality or cause service failures.

The vulnerability of the EAP Server component of the EAP-PWD protocol for wireless communication devices certified by WPA is related to the lack of explicit checks on imported elements. These imported elements do not undergo verification of scalar values and values of elements in the...

The vulnerability of the wpa_supplicant component of the EAP-PWD protocol in wireless communication devices certified by WPA allows a perpetrator to compromise the integrity and confidentiality of data or cause service failures due to improper use of privileges.

The vulnerability of the wpasupplicant component of the EAP-PWD protocol in wireless communication devices certified by WPA is related to incorrect validation of scalar values and values of elements in the “EAP-pwd-Commit” section of imported elements. Exploiting this vulnerability allows a...

The vulnerability of the pam_systemd module of the systemd daemon, related to the improper use of environmental variables, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected data.

The vulnerability of the pamsystemd module in the systemd initialization daemon is related to improper cleaning of the environment before using the variable XDGSEAT. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected data...

The vulnerability of the wpa_supplicant component of the EAP-PWD protocol in wireless communication devices certified by WPA allows attackers to compromise the integrity and confidentiality of data, as well as cause service failures. This vulnerability is related to incorrect authentication procedures.

The vulnerability of the wpasupplicant component of the EAP-PWD protocol in wireless communication devices certified for WPA is related to the failure of the EAP-PWD authentication process without obtaining a password. Exploiting this vulnerability allows an attacker to compromise the integrity a...

The vulnerability of the strncpy function in Atftpd arises from the possibility of the operation exceeding the buffer’s memory limit. This allows attackers to compromise data integrity and confidentiality, or cause service failures.

The vulnerability of the strncpy function in the Atftpd package is related to the sending of a 3-byte error message by the package. Exploiting this vulnerability allows an attacker to compromise data integrity and confidentiality, or cause service failures...

AI Isn't Good Enough When Lives Are on the Line, Experts Warn

LONDON, UK – With the infosec community eyeing artificial intelligence as the next big frontier for cyber defense, experts here at Infosecurity Europe on Tuesday warned that several challenges in how AI processes and interprets data need to first be fleshed out before widespread adoption. AI, in...

PT-2019-4831

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 75.0.3770.80 Description The issue is related to an object lifecycle problem in the V8 JavaScript engine of Google Chrome, which can lead to heap corruption. A remote attacker can potentially exploit this issue...

PT-2019-4837

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 75.0.3770.80 Description The issue is related to excessive data validation in the URL parser, allowing a remote attacker to bypass website URL validation via a crafted URL. This can be achieved if the attacker...

PT-2019-4838

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 75.0.3770.80 Description The issue is related to the security interface of the popup blocker in Google Chrome, which is associated with access control deficiencies. Exploitation of this issue may allow a remote...

PT-2019-5105

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 75.0.3770.80 Description The issue is related to an object lifecycle problem in the ServiceWorker component of Google Chrome, which can lead to out of bounds memory access. This could potentially allow a remote...

PT-2019-5109

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 75.0.3770.80 Description The issue is related to a component that determines the scope of a dialog box in the Google Chrome web browser, which is connected to an insufficient permission control mechanism...

The vulnerability of Cisco Email Security Appliance’s security systems, related to insufficient input data validation, allows attackers to compromise the integrity of the protected information.

The vulnerability of Cisco Email Security Appliance’s security systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of the protected information...

The vulnerability of the mechanism for managing the identification of web interfaces of microprogramming software-based wireless access controller devices from Cisco Wireless LAN Controllers allows attackers to compromise the integrity of protected information.

The vulnerability of the mechanism for identifying web interfaces of microprogrammed software controllers for Cisco Wireless LAN Controllers WLC is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information by...