CVE-2019-3629 Application protections bypass vulnerability could allow unauthenticated user to impersonate system users

Application protection bypass vulnerability in McAfee Enterprise Security Manager ESM prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters...

CVE-2019-3629

McAfee Enterprise Security Manager (ESM) has an authorization issue that allows an unauthenticated user to impersonate system users via specially crafted parameters. Affected versions are ESM prior to 11.2.0 and prior to 10.4.0. This is a protection bypass vulnerability in the application itself....

Privilege escalation

Privilege escalation in McAfee Enterprise Security Manager ESM 11.x prior to 11.2.0 allows authenticated user to gain access to a core system component via incorrect access control...

CVE-2019-3628

CVE-2019-3628 affects McAfee Enterprise Security Manager (ESM) 11.x before 11.2.0. An authenticated user can exploit incorrect access control to escalate privileges and access a core system component. Impact is described as privilege escalation with access to core components; remediation is to up...

CVE-2019-3628 Privilege escalation could allow authenticated user to gain access to a core system

Privilege escalation in McAfee Enterprise Security Manager ESM 11.x prior to 11.2.0 allows authenticated user to gain access to a core system component via incorrect access control...

USN-4038-2 bzip2 vulnerabilities

USN-4038-1 fixed several vulnerabilities in bzip2. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Aladdin Mubaied discovered that bzip2 incorrectly handled certain files. An attacker could possibly use this issue to cause a deni...

USN-4037-1: policykit-desktop-privileges update

The policykit-desktop-privileges Startup Disk Creator policy allowed administrative users to overwrite disks. As a security improvement, this operation now requires authentication...

USN-4030-1: web2py vulnerabilities

It was discovered that web2py does not properly check denied hosts before verifying passwords. An attacker could possibly use this issue to perform brute-force attacks. CVE-2016-10321 It was discovered that web2py allows remote attackers to obtain environment variable values. An attacker could...

@amcorvi/loadout (>=0.0.0, <=0.1.2), @amory/clean (>=2018.8.13-0, <=2018.8.13-2) +152 more potentially affected by unknown CVE via esm (>=3.0.14, <=3.0.84)

esm NPM version =3.0.14, =0.0.0, =2018.8.13-0, =2018.8.13-0, =2018.8.9-0, =2018.10.14-0, =2018.10.16-0, =2018.8.13-0, =2018.10.14-0, =2018.10.12-0, =2018.8.8-0, =2018.8.13-0, =0.4.1, =2.1.0-beta.0, =2.2.0-beta.1, =2.1.0-beta.0, =2.3.0-beta.10 and more Source cves: unknown CVE Source advisory:...

GHSA-QX4V-6GC5-F2VV Regular Expression Denial of Service

A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop...

Regular Expression Denial of Service

A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop...

USN-4023-1: Mosquitto vulnerabilities

It was discovered that Mosquitto broker incorrectly handled certain specially crafted input and network packets. A remote attacker could use this to cause a denial of service...

USN-4024-1: Evince update

As a security improvement, this update adjusts the AppArmor profile for the Evince thumbnailer to reduce access to the system and adjusts the AppArmor profile for Evince and Evince previewer to limit access to the DBus system bus. Additionally adjust the evince abstraction to disallow writes on...

USN-4020-1: Firefox vulnerability

A type confusion bug was discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could exploit this by causing a denial of service, or executing arbitrary code...

USN-4019-1: SQLite vulnerabilities

It was discovered that SQLite incorrectly handled certain SQL files. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2017-2518, CVE-2017-2520 It was discovered that SQLite incorrectly handled certain...

CVE-2019-7588

A vulnerability in the exacqVision Enterprise System Manager ESM v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of ESM running on a Windows operating system. This issue does not...

Design/Logic Flaw

A vulnerability in the exacqVision Enterprise System Manager ESM v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of ESM running on a Windows operating system. This issue does not...

CVE-2019-7588

CVE-2019-7588 affects exacqVision Enterprise System Manager (ESM) v5.12.2 and earlier on Windows. Root cause is improper authorization (CWE-285): by design, low‑privilege accounts receive excessive directory permissions, enabling application file changes and potential privilege escalation through...

CVE-2019-7588 exacqVision Enterprise System Manager (ESM) privilege escalation

A vulnerability in the exacqVision Enterprise System Manager ESM v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of ESM running on a Windows operating system. This issue does not...

USN-4017-2: Linux kernel vulnerabilities

USN-4017-1 fixed vulnerabilities in the Linux kernel for Ubuntu. This update provides the corresponding updates for the Linux kernel for Ubuntu 16.04 ESM and Ubuntu 14.04 ESM. Jonathan Looney discovered that the TCP retransmission queue implementation in the Linux kernel could be fragmented when...