UBUNTU-CVE-2019-5856

Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page...

The vulnerability of the Core RDBMS component of the database management system Oracle Database Server allows a hacker to gain access to modify, add, or delete data.

The vulnerability of the Core RDBMS component of the database management system, Oracle Database Server, is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to modify, add, or delete data using the Oracle Net protoc...

The vulnerability of the DIGSI 5 software and SIPROTEC 5 devices, which stems from insufficient validation of input data, allows attackers to trigger service interruptions.

The vulnerability of the DIGSI 5 software and the SIPROTEC 5 devices is related to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted packets to port 443/TCP...

Internet Bug Bounty: Dragonblood: Design and Implementation Flaws in WPA3 and EAP-pwd

Full background information is at our website and detailed information can be found in our research paper. Vulnerability Summary First Disclosure Summarized, the Dragonfly handshake of WPA3 and EAP-pwd is supposed to prevent dictionary attacks. However, we discovered design flaws that still enabl...

News Wrap: Amazon Ring Risks, Stalkerware, and D-Link Router Flaws

Threatpost news editors break down the top stories of the week, including: The Coalition Against Stalkerware launched this week, with the aim of offering a centralized location for helping victims of stalkerware, as well as defining what stalkerware is in the first place. Five U.S. Senators are...

IBM Tivoli Netcool Impact Information Disclosure Vulnerability

IBM Tivoli Netcool Impact is a suite of network management software from IBM in the United States. The software has the ability to automate business-critical functions and provide a platform that provides unified access to real-time data, events and indicators. An information disclosure...

Mozilla Bug Bounty Program Doubles Payouts, Adds Firefox Monitor

Mozilla is bumping up its bug bounty payouts and has added new websites and services – including the recently deployed Firefox Monitor– to its bug bounty program in hopes of attracting more researchers to sniff out vulnerabilities. The browser-maker is doubling bug bounty payouts for most of its...

There are logic flaws and vulnerabilities in the hospital logistics integrated management platform of Nanjing Bona Ruitong Software Technology Co.

Nanjing Bona Ruitong Software Technology Co., Ltd "Bona Ruitong", located in Nanjing Software Valley, Jiangsu Province, is a hospital digital logistics as the direction of business development, set industry information technology consulting and planning, application solutions to provide, software...

The vulnerability of the Web interface of the Cisco Unified Communications Manager allows a perpetrator to circumvent security restrictions and gain unauthorized access to the system.

The vulnerability of the Cisco Unified Communications Manager web interface is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to the system through a specially created HTTP request...

The vulnerability of the Security component in Java SE and Java SE Embedded software platforms allows attackers to gain unauthorized access to protected information.

The vulnerability of the Security component in Java SE and Java SE Embedded software platforms is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through various network...

The vulnerability of the Internal Operations component of the MICROS Relate CRM Software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Internal Operations component of the MICROS Relate CRM Software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...

The vulnerability of the command-line interface (CLI) of the microprogramming software for Cisco TelePresence Collaboration Endpoint devices allows a attacker to execute arbitrary code with root privileges.

The vulnerability of the command-line interface CLI of the microprogramming software for Cisco TelePresence Collaboration Endpoint devices is related to deficiencies in access control. Exploiting this vulnerability could allow a attacker to execute arbitrary code with root privileges by sending...

The vulnerability of Oracle Solaris’s Filesystem component, which allows a hacker to gain full control over the system

The vulnerability of Oracle Solaris’s Filesystem component is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain full control over the system...

The vulnerability of the Web Services sub-component of the Oracle WebLogic Server application server, a software platform of Oracle Fusion Middleware, allows a perpetrator to gain full control over the application.

The vulnerability of the Web Services sub-component of the Oracle WebLogic Server application server of the Oracle Fusion Middleware software platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full contro...

The vulnerability of the Segment component in the Oracle Retail Customer Management and Segmentation software application allows a hacker to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Segment component in Oracle Retail Customer Management and Segmentation Foundation software relates to access control deficiencies. Exploiting this vulnerability could allow an attacker operating remotely to modify, add, or delete data, or gain unauthorized access to...

The vulnerability of the Sample apps sub-component of the Oracle WebLogic Server application server, a software platform of Oracle Fusion Middleware, allows an intruder to gain unauthorized access to read, modify, add, or delete data.

The vulnerability of the Sample apps sub-component of the Oracle WebLogic Server application server, a software platform of Oracle Fusion Middleware, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized acces...

TPM-Fail Attacks Against Cryptographic Coprocessors

Really interesting research: TPM-FAIL: TPM meets Timing and Lattice Attacks, by Daniel Moghimi, Berk Sunar, Thomas Eisenbarth, and Nadia Heninger. Abstract: Trusted Platform Module TPM serves as a hardware-based root of trust that protects cryptographic keys from privileged system and physical...

146 New Vulnerabilities All Come Preinstalled on Android Phones

The dozens of flaws across 29 Android smartphone makers show just how insecure the devices can be, even brand-new...

CVE-2019-15800

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. Due to lack of input validation in the cmdsystracerouteexec, cmdsysarpclear, and cmdsyspingexec functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call...

USN-4185-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle vulnerabilities

Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida, Giorgi Maisuradze, Moritz Lipp, Michael Schwarz, Daniel Gruss, and Jo Van Bulck discovered that Intel processors using Transactional Synchronization Extensions TSX could expose...