Multiple Intel Processors CVE-2019-14607 Multiple Security Vulnerabilities

Description Multiple Intel Processors are prone to multiple security vulnerabilities. A local attacker can leverage these issues to obtain sensitive information, gain elevated privileges and cause denial of service conditions. This may aid in further attacks. Technologies Affected Intel 6th...

CVE-2019-19521

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/authsubr.c and gen/authenticate.c in libc and login/login.c and xenocara/app/xenodm/greeter/verify.c...

Authentication flaw

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/authsubr.c and gen/authenticate.c in libc and login/login.c and xenocara/app/xenodm/greeter/verify.c...

CVE-2019-19521: Improper Authentication

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/authsubr.c and gen/authenticate.c in libc and login/login.c and xenocara/app/xenodm/greeter/verify.c...

CVE-2019-19059

A flaw was found in the way the Intel Wireless driver in the Linux kernel handled resource cleanup during Gen 3 device initialization. This flaw allows an attacker with the ability to restrict access to DMA coherent memory on device initialization, to crash the system. Mitigation In order to...

Design/Logic Flaw

Insufficient memory protection in IntelR 6th Generation Core Processors and greater, supporting SGX, may allow a privileged user to potentially enable escalation of privilege via local access...

HPESBHF03968 rev.4 - HPE Gen10 ProLiant, Apollo, Superdome Flex, and Synergy Servers using Intel CPU Transactional Synchronization Extensions (TSX) Asynchronous Abort (TAA), Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 4200 Gen10 Server - Prior to V2.22 ROM HPE Apollo 2000 System - Prior to V2.22 ROM HPE ProLiant BL460c Gen10 Server Blade - Prior to V2.22 ROM HPE ProLiant DL580...

PT-2019-4065 · Intel · Intel Xeon E-2200 +4

Name of the Vulnerable Software and Affected Versions: IntelR CoreTM Processor families versions 6th through 9th IntelR XeonR Processor E3-1500 versions v5 and v6 IntelR XeonR E-2100 and E-2200 Processor families with IntelR Processor Graphics Description: The issue is related to insufficient...

ALBA-2019:3411 lttng-ust bug fix and enhancement update

This update fixes two issues in lttng-ust and subpackages. There was a bad shebang in the /usr/bin/lttng-gen-tp utility that prevented users from executing it. This issue has been fixed. lttng-ust was only available for x8664 architectures. lttng-ust is now available for all architectures support...

PT-2019-1030

Name of the Vulnerable Software and Affected Versions: lttng-ust affected versions not specified Description: The issue concerns a bad shebang in the /usr/bin/lttng-gen-tp utility, which prevented users from executing it. Additionally, lttng-ust was initially only available for x86 64 architectur...

A Web-Driven World Needs Better Web Security

Web interfaces are everywhere. From social media sites to online shopping portals to your CRM, the humble web interface is now used to access much of the online world. So, it isn’t difficult to see why web applications are a prime target for cybercriminals. Because they’re used by customers and...

CVE-2019-13336: Improper Authentication

The dbell Wi-Fi Smart Video Doorbell DB01-S Gen 1 allows remote attackers to launch commands with no authentication verification via TCP port 81, because the loginuse and loginpass parameters to openlock.cgi can have arbitrary values. NOTE: the vendor's position is that this product reached end o...

PT-2019-13272 · Dbell · Dbell Wi-Fi Smart Video Doorbell Db01-S

Name of the Vulnerable Software and Affected Versions: dbell Wi-Fi Smart Video Doorbell DB01-S version Gen 1 Description: The issue allows remote attackers to launch commands with no authentication verification via TCP port 81. This is because the loginuse and loginpass parameters to "openlock.cg...

EulerOS 2.0 SP5 : gettext (EulerOS-SA-2019-1966)

According to the version of the gettext packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read-catalog.c, related to an invalid free in...

Apple Security Update: iOS 9.3.6

Apple recommends to install security update iOS 9.3.6 on devices iPhone 4s, iPad mini 1st generation Wi-Fi + Cellular, iPad 2 Wi-Fi + Cellular, iPad 3rd generation Wi-Fi + Cellular...

CVE-2019-1010287

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

CVE-2019-1010287

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...

CVE-2019-1010287

Timesheet Next Gen vulnerable to reflected XSS (CVE-2019-1010287) in login.php (lines 40 and 54) via a redirect parameter. Affected: Timesheet Next Gen versions 1.5.3 and earlier. Impact: attacker can cause arbitrary HTML/JavaScript execution when a user clicks a malicious URL. Affected vector: r...

PT-2019-11542 · Timesheet · Timesheet Next Gen

Name of the Vulnerable Software and Affected Versions: Timesheet Next Gen versions 1.5.3 and earlier Description: The issue allows an attacker to execute arbitrary HTML and JavaScript code via a redirect parameter. This is a reflected Cross Site Scripting XSS attack, where the victim may click on...

CVE-2019-1010287: Improper Neutralization of Input During Web Page Generation

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may...