Input validation

A vulnerability in the web UI of the Cisco Firepower Management Center FMC could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted...

Ubuntu: Security Advisory (USN-4144-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ESXi 6.0 / 6.5 / 6.7 Use-After-Free (VMSA-2019-0014)

The remote VMware ESXi host is version 6.0, 6.5 or 6.7 and is affected by a use-after-free error in the virtual sound device that allows a local attacker on the guest machine with low privileges to execute code on the host. Note that Nessus has not tested for this issue but has instead relied onl...

VMware Horizon View Client 5.x < 5.2.0 Use-After-Free (VMSA-2019-0014)

The version of VMware Horizon View Client installed on the remote host is 5.x prior to 5.2.0. It is, therefore, affected by a use-after-free error in the virtual sound device that allows a local attacker on the guest machine with low privileges to execute code on the host. Note that Nessus has no...

LibreOffice Security Restriction Bypass Vulnerability

LibreOffice is an open source office software suite from The Document Foundation TDF. The product includes applications such as Writer text documents, Calc spreadsheets and Impress presentations. A security vulnerability exists in LibreOffice. An attacker could exploit the vulnerability to bypass...

The vulnerability of Firefox ESR, related to privilege management errors, allows a hacker to elevate their privileges and execute arbitrary code.

The vulnerability of Firefox ESR is related to privilege management errors. Exploiting this vulnerability allows a remote attacker to increase their privileges and execute arbitrary code...

Design/Logic Flaw

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system OS. The vulnerability is due to insufficient enforcement of the consent token in authorizing shell...

CVE-2019-14239

On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls FAC a software IP protection method for execute-only access can be defeated by leveraging a load instruction inside the execute-only region to expose the protected code into a CPU register...

Improper access control

On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls FAC a software IP protection method for execute-only access can be defeated by leveraging a load instruction inside the execute-only region to expose the protected code into a CPU register...

CVE-2019-14239

On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls FAC a software IP protection method for execute-only access can be defeated by leveraging a load instruction inside the execute-only region to expose the protected code into a CPU register...

EulerOS 2.0 SP5 : php (EulerOS-SA-2019-1984)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The geticudispvaluesrcphp function in ext/intl/locale/localemethods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not...

Buffer overflow

Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI...

CVE-2019-15000

The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 the fixed version for 5.16.x , from 6.0.0 before 6.0.10 the fixed version for 6.0.x, from 6.1.0 before 6.1.8 the fixed version for 6.1.x, from 6.2.0 before 6.2.6 the fixed version for 6.2.x, from 6.3.0 before 6.3.5 t...

nexus2-oss -- Multiple vulerabilities

Sonatype reports: Several RCE vulnerabilities have been found and corrected in 2.14.15: CVE-2019-16530: An attacker with elevated privileges can upload a specially crafted file. That file can contain commands that will be executed on the system, with the same privileges as the user running the...

Sql injection

A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const in Terrasoft Bpm'online CRM-System SDK 7.13 allows attackers to execute arbitrary SQL commands via the value parameter...

CVE-2019-16391

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiseraction.php...

EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2019-1858)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or...

Jenkins Skytap Cloud CI Cleartext Storage of Credentials Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Jenkins Skytap Cloud CI. Authentication is required to exploit this vulnerability. The specific flaw exists within the Skytap Cloud CI plugin. The issue results from storing credentials in...

Security Bulletin: Synthetic Playback Agent 8.1.4 is affected by multiple vulnerabilities

Summary Synthetic Playback Agent has addressed the following vulnerabilities: CVE-ID: CVE-2019-11710 CVE-ID: CVE-2019-11721 CVE-ID: CVE-2019-11711 CVE-ID: CVE-2019-11730 CVE-ID: CVE-2019-11720 CVE-ID: CVE-2019-11714 CVE-ID: CVE-2019-11725 CVE-ID: CVE-2019-11715 CVE-ID: CVE-2019-11712 CVE-ID:...

Google Chrome Mojo Resource Management Error Vulnerability

Google Chrome is a web browser. A security vulnerability in Google Chrome Mojo allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be tricked into parsing by users, which can crash applications or execute arbitrary code...