[SECURITY] [DLA 1956-1] ruby-openid security update

Package : ruby-openid Version : 2.5.0debian-1+deb8u1 CVE ID : CVE-2019-11027 ruby-openid performed discovery first, and then verification. This allowed an attacker to change the URL used for discovery and trick the server into connecting to the URL. This server in turn could be a private server n...

Cross site scripting

In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors...

CVE-2019-17427

In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors...

Internet Explorer Script Handler RCE

The vulnerability of the Internet Explorer browser’s script handler exists due to errors in memory object handling. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Firefox Display Error Spear Phishing

The vulnerability of Firefox browsers arises due to errors in the character display in file names within the “Downloads” tab. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

Norton Password Manager Module IP Address Replacement

The vulnerability of the Norton Password Manager password manager is related to errors in IP packet processing. Exploiting this vulnerability could allow a malicious actor to replace the IP address...

Cisco Firepower Management Center SQL Injection

The vulnerability of the web interface for managing the software-hardware environment of Cisco Firepower Management Center is related to input validation errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Cisco Adaptive Security Appliances SIP DoS

The vulnerability of the SIP protocol implementation in Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense FTD is related to errors in processing SIP packets. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

FTD Multi-connection Mode Privilege Escalation

The vulnerability of the multi-connection mode of the Firepower Threat Defense FTD software relates to security configuration errors. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges from within the FTD instance...

baseURI component Data Compromise

The vulnerability of the baseURI component in browsers such as Firefox ESR, Firefox, and the email client Thunderbird is related to permission handling errors. Exploiting this vulnerability can allow a malicious actor to influence the integrity of protected information from a remote location...

baseURI component Data Compromise

The vulnerability of the baseURI component in browsers such as Firefox ESR, Firefox, and the email client Thunderbird is related to permission handling errors. Exploiting this vulnerability can allow a malicious actor to influence the integrity of protected information from a remote location...

Cisco Firepower Management Center SQL Injection

The vulnerability of the web interface for managing the software-hardware environment of Cisco Firepower Management Center is related to input validation errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Cisco Firepower Management Center SQL Injection

The vulnerability of the web interface for managing the software-hardware environment of Cisco Firepower Management Center is related to input validation errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Microsoft Windows Defender DoS

The vulnerability of Microsoft Windows Defender arises due to file processing errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2019-3640

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description The issue is related to errors in handling objects in memory by the ChakraCore JavaScript engine. This could allow a remote attacker to execute arbitrary code in the context of the...

PT-2019-3638

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description The issue is related to errors in handling objects in memory by the ChakraCore JavaScript engine. This could allow a remote attacker to execute arbitrary code in the context of the...

PT-2019-3632

Name of the Vulnerable Software and Affected Versions Internet Explorer affected versions not specified Description A remote code execution issue exists due to errors in handling objects in memory by the VBScript engine. This could allow a remote attacker to execute arbitrary code in the context ...

PT-2019-3637

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description The issue is related to errors in handling objects in memory by the ChakraCore JavaScript engine. This could allow a remote attacker to execute arbitrary code in the context of the...

Code injection

The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate. Although the certificate chain must contain one of a set of pinned certificates, there are certain implementation errors such as a lack of hostname verification. NOTE: this is an...

CVE-2009-0136

Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service application crash or execute arbitrary code via an Audible Audio .aa file with a crafted 1 nlen or 2 vlen Tag...