Philips Holter 2010 Plus Access Control Error Vulnerability

Philips Holter 2010 Plus is a suite of ambulatory ECG monitoring software from Philips Europe. A security bypass vulnerability exists in Philips Holter 2010 Plus all versions. A local attacker can exploit this vulnerability to bypass security restrictions and gain unauthorized access to disabled...

Apple Disables Walkie-Talkie App Due to Eavesdropping Flaw

Apple has temporarily disabled the Walkie-Talkie feature from the Apple Watch due to a vulnerability that could allow potential attackers to eavesdrop in on iPhone calls, a TechCrunch report said. The Apple Watch Walkie-Talkie app allows users to converse with friends in real-time, without having...

The vulnerability of the BARS.Web-Sudy platform, related to the lack of mechanisms to limit the number of authentication attempts, allows a violator to select a user password.

The vulnerability of the BARS.Web-Sudy platform is related to deficiencies in the mechanism for limiting the number of authentication attempts. Exploiting this vulnerability allows a malicious actor to select a user password by disabling the reception of cookies from the browser...

DEBIAN-CVE-2019-13031

LemonLDAP::NG before 1.9.20 has an XML External Entity XXE issue when submitting a notification to the notification server. By default, the notification server is not enabled and has a "deny all" rule...

The vulnerability in the implementation of the ips_init_phase1 function in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability in the implementation of the ipsinitphase1 function, which is called from the ipsinsertdevice handler in the loaded module drivers/scsi/ips.ko of the Linux operating system, stems from a memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

PRODSECBUG-2300: Information about disabled products can be leaked due to inadequate validation checks

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...

PRODSECBUG-2301: Names of disabled products can be leaked due to inadequate validation checks

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...

June 20, 2019—KB4503277 (Preview of Monthly Rollup)

None None...

SUSE-SU-2019:1523-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-11472: Fixed a denial-of-service in ReadXWDImage bsc1133204. - CVE-2019-11470: Fixed a denial-of-service in ReadCINImage bsc1133205. - CVE-2019-11506: Fixed a heap-based buffer overflow in the WriteMATLABIma...

The vulnerability in the “Regional Program Capital Renovation Management” platform relates to a lack of mechanisms to limit the number of authentication attempts. This allows a violator to select a user password.

The vulnerability in the “Regional Program Capital Renovation Management” platform is related to a deficiency in the mechanism for limiting the number of authentication attempts. Exploiting this vulnerability allows a malicious actor to select a user password by disabling the reception of cookies...

CVE-2019-9881

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...

Code injection

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...

CVE-2019-9881

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...

PT-2019-19914

Name of the Vulnerable Software and Affected Versions: WPGraphQL version 0.2.3 Description: The issue allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled, through the createComment mutation. Recommendations: For WPGraphQL version 0.2.3, consider...

USN-4008-2 apparmor update

USN-4008-1 fixed multiple security issues in the Linux kernel. This update provides the corresponding changes to AppArmor policy for correctly operating under the Linux kernel with fixes for CVE-2019-11190. Without these changes, some profile transitions may be unintentionally denied due to missi...

USN-4008-1 linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

Robert Święcki discovered that the Linux kernel did not properly apply Address Space Layout Randomization ASLR in some situations for setuid elf binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerability in a setuid elf binary. CVE-2019-11190 It was...

CVE-2019-6321

HP has identified a security vulnerability with some versions of Workstation BIOS UEFI Firmware where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerability relates to Workstations whose TPM is disabled by default...

CVE-2019-6322

HP has identified a security vulnerability with some versions of Workstation BIOS UEFI Firmware where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerability relates to Workstations whose TPM is enabled by default...

UBUNTU-CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

UBUNTU-CVE-2019-9816

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all...