CVE-2019-15686

Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component allowed an attacker remotely disable various anti-virus protection features. DoS, Bypass...

CVE-2019-13675

Insufficient data validation in extensions in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to disable extensions via a crafted HTML page...

Threat Analysis Unit (TAU) Threat Intelligence Notification: AsyncRAT

AsyncRAT is a Remote Access Tool RAT designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop...

Stealthy Microsoft SQL Server Backdoor Malware Spotted in the Wild

Cybersecurity researchers claim to have discovered a previously undocumented backdoor specifically designed for Microsoft SQL servers that could allow a remote attacker to control an already compromised system stealthily. Dubbed Skip-2.0 , the backdoor malware is a post-exploitation tool that run...

Security Bulletin: Vulnerability in SSLv3 affects Netezza Performance Portal (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Netezza Performance Portal. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

The vulnerabilities in the modules src/User.cpp, src/znc.cpp, and src/IRCNetwork.cpp, which are responsible for disabling clients from connecting to the IRC server or the selected channel, allow a malicious actor to cause service failures.

The vulnerabilities in the modules src/User.cpp, src/znc.cpp, and src/IRCNetwork.cpp, which allow for disabling clients from connecting to the IRC server or the selected channel, exist due to insufficient validation of input data. Exploiting these vulnerabilities could enable a malicious actor to...

Privilege escalation

Privilege escalation vulnerability in McAfee Agent MA before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by manipulating the MA directory control and placing a carefully constructed file in the MA directory...

Nextcloud: Blind Stored XSS on iOS App due to Unsanitized Webview

Hi Team! I found a Blind XSS can executed on iOS App due to unsanitized webview. Using this issue, attacker can extract information from victim. Steps To Reproduce: 1. Upload malicious HTML, share to victim 2. Waiting victim to open it F487447 F487448 HTML payload attached, don't forget to change...

PT-2019-19427

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.3 through 11.2 Description The issue allows superusers and users in the 'pg execute server program' group to execute arbitrary code in the context of the database's operating system user through the "COPY TO/FROM PROGRAM"...

Security Bulletin: Vulnerability in RC4 stream cipher affects MegaRAID Storage Manager (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects MegaRAID Storage Manager. MegaRAID Storage Manager has addressed the vulnerability. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects MegaRAID Storage Manager. MegaRAID Storage Manager has addressed the...

Security Bulletin: Vulnerability in SSLv3 affects IBM Chassis Management Module (CMM) (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Chassis Management Module CMM. Vulnerability Details Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle...

Microsoft Office SharePoint CVE-2019-0557 Cross Site Scripting Vulnerability

Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

VMware WorkstationPlayer 12.5.5 - Local Privilege Escalation

VMware WorkstationPlayer 12.5.5 - Local Privilege Escalation !/bin/bash VMware Workstation Local Privilege Escalation exploit CVE-2017-4915 - https://www.vmware.com/security/advisories/VMSA-2017-0009.html - https://www.exploit-db.com/exploits/42045/ Affects: - VMware Workstation Player...

PT-2018-2289 · Systemd +5 · Systemd-Journal-Remote +6

Name of the Vulnerable Software and Affected Versions: systemd-journald versions through v240 systemd-journal-remote versions through v240 Description: The issue is caused by an unbounded memory allocation in the systemd-journald and systemd-journal-remote binary system, which can lead to a stack...

Ghostscript - Multiple Vulnerabilities

Exploit for linux platform in category local exploits http://seclists.org/oss-sec/2018/q3/142 These are critical and trivial remote code execution bugs in things like ImageMagick, Evince, GIMP, and most other PDF/PS tools. ---- Hello, this was discussed on the distros list, but it was suggested t...

SUSE-SU-2018:2394-1 Security update for kgraft

This update for kgraft fixes the following issues: Add script for disabling SMT to help with the mitigation of the 'L1 Terminal Fault' issue CVE-2018-3646 bsc1099306 The script is called 'klp-kvm-l1tf-ctrl-smt' and is used for enabling or disabling SMT to mitigate the issue when this administrati...

Bluetooth “BlueBorne” Vulnerabilities - NL

Lenovo Security Advisory: LEN-17125 Potential Impact: Remote code execution Severity: High Scope of Impact: Industry wide CVE Identifier: CVE-2017-0781, CVE-2017-0782, CVE-2017-0783, CVE-2017-0785, CVE-2017-8628, CVE-2017-14315, CVE-2017-1000250, CVE-2017-1000251 Summary Description: A collection...

Security Bulletin: Vulnerability in SSLv3 affects IBM Rational ClearCase (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Rational ClearCase. Vulnerability Details CVE-ID: CVE-2014-3566 Description: ClearCase could allow a remote attacker to obtain sensitive...

Security Bulletin: Vulnerability in SSLv3 affects Tivoli Netcool Performance Manager(TNPM Wireless)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Tivoli Netcool Performance Manager TNPM Wireless through Tivoli Directory Server, IBM WebSphere Application Server and Apache Tomcat...

Security Bulletin: Vulnerability in SSLv3 affects IBM CommonStore and IBM Content Collector (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM CommonStore for Lotus Domino and IBM Content Collector. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remo...