NewStart CGSL MAIN 5.04 : apr Vulnerability (NS-SA-2019-0001)

The remote NewStart CGSL host, running version MAIN 5.04, has apr packages installed that are affected by a vulnerability: - An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lea...

NewStart CGSL MAIN 4.05 : apr Vulnerability (NS-SA-2019-0115)

The remote NewStart CGSL host, running version MAIN 4.05, has apr packages installed that are affected by a vulnerability: - An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lea...

DEBIAN-CVE-2019-14433

An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensiti...

CVE-2019-14433

An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensiti...

The vulnerability of the AdaptiveThresholdImage function in the console-based image editing tool ImageMagick allows a hacker to cause a service failure or expose protected information.

The vulnerability of the AdaptiveThresholdImage function MagickCore/threshold.c in the console-based image editing tool ImageMagick involves reading data beyond the buffer boundaries in dynamic memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or reveal...

kernel: hw: Spectre SWAPGS gadget vulnerability

A Spectre gadget was found in the Linux kernel's implementation of system interrupts. An attacker with local access could use this information to reveal private data through a Spectre like side channel...

Binance KYC Data Leak — Crypto Exchange Sets $290,000 Bounty On Blackmailer

Malta-based cryptocurrency exchange Binance has become a victim of a ransom demand from a scammer who claimed to have hacked the KYC Know Your Customer data of thousands of its customers. The unknown attacker threatened the world's largest cryptocurrency exchange by volume to release KYC...

CVE-2019-4284

IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as another user. IBM X-Force ID: 160512...

Nextcloud: Talk - Leak of password-protected room name via already existent resource addition

CVSS ---- Medium 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Description ----------- Affected: Talk / Spreed 6.0.3 The name of shared but password-protected rooms leaks to low-privileged authenticated users. An attacker does not need to guess room IDs, but can simply iterate over IDs to gath...

CVE-2019-13626

An out-of-bounds read flaw was discovered in SDL2, in the way that WAVE files are loaded through the SDLLoadWAVRW function. An application that uses SDL2 and loads untrusted input files may be vulnerable to this flaw. An attacker can abuse this flaw to crash the application or to leak data from t...

CVE-2019-13303

A heap-based buffer over-read was discovered in ImageMagick in the way it composes images. Applications compiled against ImageMagick libraries that accept untrustworthy images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to make the...

The vulnerability of the Jenkins Credentials plugin, related to the leakage of file and directory information, allows attackers to create or update credentials and gain access to files containing PKCS#12 certificates.

The vulnerability of the Jenkins Credentials plugin is related to the leakage of information about files and directories. Exploiting this vulnerability allows a malicious actor to create or update credentials and gain access to files containing PKCS12 certificates...

iOS URL Scheme Could Let App-in-the-Middle Attackers Hijack Your Accounts

Security researchers have illustrated a new app-in-the-middle attack that could allow a malicious app installed on your iOS device to steal sensitive information from other apps by exploiting certain implementations of Custom URL Scheme. By default on Apple's iOS operating system, every app runs...

CVE-2019-1010294

Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Rounding error. The impact is: Potentially leaking code and/or data from previous Trusted Application. The component is: opteeos. The fixed version is: 3.4.0 and later...

CVE-2019-13604

There is a short key vulnerability in HID Global DigitalPersona formerly Crossmatch U.are.U 4500 Fingerprint Reader v24. The key for obfuscating the fingerprint image is vulnerable to brute-force attacks. This allows an attacker to recover the key and decrypt that image using the key. Successful...

A week in security (July 1 – 7)

Last week on Malwarebytes Labs, we explained what to do when you find stalkerware, how cooperating apps and automatic permissions are setting you up for failure, and why you should steer clear of Bitcoin Cash generators. Other cybersecurity news: A former Chief Information Officer CIO of Equifax...

Related vulnerabilities have now been patched: the Orvibo smart home devices disclosure of user information-bug warning-the black bar safety net

From Orvibo aspect to understand, this relates to the information disclosure of the security vulnerability has now been fixed, and the user information of the protection level, at the same time they also want and professional information security research team into cooperation with the protection...

Dating App Jack'd Fined After Leaking Users' Nude Pics

LGBTQ dating app Jack’d must cough up a $240,000 fine and “make substantial changes to improve security” on the heels of a security faux pas that leaked the private data – including nude photos – of thousands of its users. Jack’d is a popular location-based app that caters to gay and bisexual men...

CVE-2019-4299

The CVE concerns IBM Robotic Process Automation with Automation Anywhere (11.0). A local attacker could access highly sensitive information from debug log files due to a logging exposure in the Client; the root cause is log data written when debugging is enabled. Impact is indicated as HIGH confi...

Unspecified vulnerability in Linux kernel (CNVD-2019-38275)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the 'dohidpsockioctl' function in the net/bluetooth/hidp/sock.c file in versions of Linux kernel prior to 5.0.15. An attacker can...