CVE-2019-9881

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...

Code injection

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...

CVE-2019-9881

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...

PT-2019-19914

Name of the Vulnerable Software and Affected Versions: WPGraphQL version 0.2.3 Description: The issue allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled, through the createComment mutation. Recommendations: For WPGraphQL version 0.2.3, consider...

USN-4008-2 apparmor update

USN-4008-1 fixed multiple security issues in the Linux kernel. This update provides the corresponding changes to AppArmor policy for correctly operating under the Linux kernel with fixes for CVE-2019-11190. Without these changes, some profile transitions may be unintentionally denied due to missi...

USN-4008-1 linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

Robert Święcki discovered that the Linux kernel did not properly apply Address Space Layout Randomization ASLR in some situations for setuid elf binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerability in a setuid elf binary. CVE-2019-11190 It was...

CVE-2019-6321

HP has identified a security vulnerability with some versions of Workstation BIOS UEFI Firmware where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerability relates to Workstations whose TPM is disabled by default...

CVE-2019-6322

HP has identified a security vulnerability with some versions of Workstation BIOS UEFI Firmware where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerability relates to Workstations whose TPM is enabled by default...

UBUNTU-CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

UBUNTU-CVE-2019-9816

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all...

Bound Check Bypass

Mozilla Thunderbird is vulnerable to bound check bypass. It does not properly perform bounds checking when Spectre mitigations are disabled...

CVE-2019-10922

A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier All versions, SIMATIC PCS 7 V8.1 and newer All versions, SIMATIC WinCC V7.2 and earlier All versions, SIMATIC WinCC V7.3 and newer All versions. An attacker with network access to affected installations, which are configured...

How to Log On to StoreFront When Authentication is Disabled on NetScaler Gateway VIP

This article provides information on how to log on to StoreFront when authentication is disabled on NetScaler Gateway VIP...

HPSBHF03614 rev. 1 - Processor Registers Left Unlocked When TPM is Disabled

Potential Security Impact Escalation of Privilege, Denial of Service, Information Disclosure, Loss of Confidentiality, Loss of Integrity Source: HP, HP Product Security Response Team PSRT Reported By: HP Inc. VULNERABILITY SUMMARY HP has identified a security vulnerability with some versions of...

The IBM Installation Manager version 1.8.9.4 Web Server capability is disabled

Problem The IBM Installation Manager web server capability which allows the Installation Manager to be run using a web browser has been disabled in the 1.8.9.4 release. This is related to Eclipse Jetty vulnerabilities described in security bulletin Multiple vulnerabilities in Eclipse Jetty affect...

Arbitrary Code Execution

Keystone is a Python implementation of the OpenStack http://www.openstack.org identity service API. It was found that Keystone incorrectly handled authorization failures. If a client attempted to change their tenant membership to one they are not authorized to join, Keystone correctly returned a...

PT-2019-11716 · Jenkins · Jenkins Koji Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Koji Plugin affected versions not specified Description: The issue concerns the Jenkins Koji Plugin, which disables SSL/TLS and hostname verification globally for the Jenkins master JVM. This means the plugin unconditionally disables...

April 25, 2019—KB4493453 (Preview of Monthly Rollup)

None None...

CVE-2013-7470

cipsov4validate in include/net/cipsoipv4.h in the Linux kernel before 3.11.7, when CONFIGNETLABEL is disabled, allows attackers to cause a denial of service infinite loop and crash, as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310...

UBUNTU-CVE-2013-7470

cipsov4validate in include/net/cipsoipv4.h in the Linux kernel before 3.11.7, when CONFIGNETLABEL is disabled, allows attackers to cause a denial of service infinite loop and crash, as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310...