CVE-2018-17791

Newgen OmniFlow Intelligent Business Process Suite iBPS 7.0 has an "improper server side validation" vulnerability where client-side validations are tampered, and inappropriate information is stored on the server side and fetched from the server every time the user visits the D, creating business...

Input validation

Newgen OmniFlow Intelligent Business Process Suite iBPS 7.0 has an "improper server side validation" vulnerability where client-side validations are tampered, and inappropriate information is stored on the server side and fetched from the server every time the user visits the D, creating business...

CVE-2019-15028

In Joomla! before 3.9.11, inadequate checks in comcontact could allow mail submission in disabled forms...

CVE-2019-15028

In Joomla! before 3.9.11, inadequate checks in comcontact could allow mail submission in disabled forms...

Design/Logic Flaw

In Joomla! before 3.9.11, inadequate checks in comcontact could allow mail submission in disabled forms...

CVE-2018-20954

The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys...

PT-2019-11777 · Jenkins · Jenkins Codefresh Integration Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Codefresh Integration Plugin versions 1.8 and earlier Description: The issue concerns the Jenkins Codefresh Integration Plugin, which unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM. This...

CVE-2019-7887

A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is...

IBM Cloud Private Privilege Escalation Vulnerability

IBM Cloud Private is a set of enterprise private cloud solutions from IBM USA. The product is built primarily on Kubernetes and container technology. A privilege escalation vulnerability exists in IBM Cloud Private versions 3.1.1 and 3.1.2, which stems from the program failing to disable a sessio...

July 16, 2019—KB4507437 (Preview of Monthly Rollup)

None None...

Philips Holter 2010 Plus Access Control Error Vulnerability

Philips Holter 2010 Plus is a suite of ambulatory ECG monitoring software from Philips Europe. A security bypass vulnerability exists in Philips Holter 2010 Plus all versions. A local attacker can exploit this vulnerability to bypass security restrictions and gain unauthorized access to disabled...

Apple Disables Walkie-Talkie App Due to Eavesdropping Flaw

Apple has temporarily disabled the Walkie-Talkie feature from the Apple Watch due to a vulnerability that could allow potential attackers to eavesdrop in on iPhone calls, a TechCrunch report said. The Apple Watch Walkie-Talkie app allows users to converse with friends in real-time, without having...

The vulnerability of the BARS.Web-Sudy platform, related to the lack of mechanisms to limit the number of authentication attempts, allows a violator to select a user password.

The vulnerability of the BARS.Web-Sudy platform is related to deficiencies in the mechanism for limiting the number of authentication attempts. Exploiting this vulnerability allows a malicious actor to select a user password by disabling the reception of cookies from the browser...

DEBIAN-CVE-2019-13031

LemonLDAP::NG before 1.9.20 has an XML External Entity XXE issue when submitting a notification to the notification server. By default, the notification server is not enabled and has a "deny all" rule...

The vulnerability in the implementation of the ips_init_phase1 function in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability in the implementation of the ipsinitphase1 function, which is called from the ipsinsertdevice handler in the loaded module drivers/scsi/ips.ko of the Linux operating system, stems from a memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

PRODSECBUG-2301: Names of disabled products can be leaked due to inadequate validation checks

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...

PRODSECBUG-2300: Information about disabled products can be leaked due to inadequate validation checks

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...

June 20, 2019—KB4503277 (Preview of Monthly Rollup)

None None...

SUSE-SU-2019:1523-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-11472: Fixed a denial-of-service in ReadXWDImage bsc1133204. - CVE-2019-11470: Fixed a denial-of-service in ReadCINImage bsc1133205. - CVE-2019-11506: Fixed a heap-based buffer overflow in the WriteMATLABIma...

The vulnerability in the “Regional Program Capital Renovation Management” platform relates to a lack of mechanisms to limit the number of authentication attempts. This allows a violator to select a user password.

The vulnerability in the “Regional Program Capital Renovation Management” platform is related to a deficiency in the mechanism for limiting the number of authentication attempts. Exploiting this vulnerability allows a malicious actor to select a user password by disabling the reception of cookies...