PT-2019-9072

Name of the Vulnerable Software and Affected Versions CyberArk Endpoint Privilege Manager versions 10.2.1.603 and earlier Description The issue allows an attacker who can edit file permissions to bypass access restrictions and execute blocked applications. Recommendations For versions 10.2.1.603...

CVE-2018-14894: Improper Privilege Management

CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker who is able to edit permissions of a file to bypass intended access restrictions and execute blocked applications...

EulerOS Virtualization 2.5.4 : ghostscript (EulerOS-SA-2019-1209)

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was discovered that ghostscript did not properly verify the key used in aesdecode. An attacker could possibly exploit this...

EulerOS Virtualization 2.5.4 : ghostscript (EulerOS-SA-2019-1215)

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The settextdistance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does...

EulerOS Virtualization 2.5.3 : ghostscript (EulerOS-SA-2019-1205)

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was discovered that the ghostscript .tempfile function did not properly handle file permissions. An attacker could possibl...

KLA11461 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Microsoft Office Access Connectivit...

CVE-2018-20341

WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute arbitrary code on a target system. If the executable is enclosed in quote tags "" then the system will know where to find it. However if the path of where th...

CVE-2019-10905

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

Google Chrome Shell Integration External Program Execution

The vulnerability of Shell Integration in the Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute external programs using a specially created HTML page...

GNU Wget Buffer Overflow Vulnerability

GNU Wget is a set of free software developed by the GNU Project for downloading over the Internet, which supports downloading over the three most common TCP/IP protocols: HTTP, HTTPS, and FTP. A buffer overflow vulnerability exists in GNU Wget. An attacker could exploit the vulnerability to cause...

CVE-2018-4178

A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue affected versions prior to macOS High Sierra 10.13.4...

Cross site scripting

XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server...

CVE-2019-4014

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 155892...

PT-2019-10812

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.13.4 Description A permissions issue existed where execute permission was incorrectly granted. This was addressed with improved permission validation. Recommendations For versions prior to 10.13.4, update to macOS Hi...

CVE-2018-4178: Incorrect Permission Assignment for Critical Resource

A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue affected versions prior to macOS High Sierra 10.13.4...

CVE-2019-5524

VMware Workstation 14.x before 14.1.6 and Fusion 10.x before 10.1.6 contain an out-of-bounds write vulnerability in the e1000 virtual network adapter. This issue may allow a guest to execute code on the host...

CVE-2019-5524

VMware Workstation 14.x before 14.1.6 and Fusion 10.x before 10.1.6 contain an out-of-bounds write vulnerability in the e1000 virtual network adapter. This issue may allow a guest to execute code on the host...

CVE-2019-1010260

The connected documents confirm a vulnerability in com.github.shyiko.ktlint:ktlint-core where downloading and executing custom rulesets over HTTP can be compromised via a MITM, allowing arbitrary code execution. The issue arises from serving jars that can be tampered, enabling exploitation during...

Debian: Security Advisory (DLA-1738-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Event Streams is affected by Alpine vulnerability CVE-2018-1000849

Summary IBM Event Streams has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1000849 DESCRIPTION: Alpine Linux could allow a remote attacker to execute arbitrary code on the system, caused by an unspecified flaw in apk-tools. By persuading a victim to open a...