Control Center-I Advisory

Summary: A potential security vulnerability in Control Center-I may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2019-14599 Description: Unquoted service path in Control Center-I version 2.1.0.0 and...

[SECURITY] Fedora 30 Update: squid-4.9-2.fc30

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DN...

Security Bulletin: Vulnerability CVE-2019-10218 in Samba affects IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-10218 DESCRIPTION: A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with...

apcd.org.br Cross Site Scripting vulnerability

Security Researcher Gh05tPT Helped patch 6836 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting apcd.org.br website and its users. Following coordinated...

hw: Intel GPU Denial Of Service while accessing MMIO in lower power state

A flaw was found in Intel graphics hardware GPU where a local attacker with the ability to issue an ioctl could trigger a hardware level crash if MMIO registers were read while the graphics card was in a low-power state. This creates a denial of service situation and the GPU and connected display...

Honeywell MCR Web Controller Cross Site Scripting / Path Disclosure

Honeywell MCR Web Controller Full Path Disclosure & Cross Site Scripting Vendor Homepage: https://www.honeywell.com WebVersion: XL1000C50 EXCEL WEB 52 I/O, XL1000C500 EXCEL WEB 300 I/O, XL1000C100 EXCEL WEB 104 I/O, XL1000C1000 EXCEL WEB 600 I/O, XL1000C50U EXCEL WEB 52 I/O UUKL, XL1000C500U EXCE...

Fedora Update for nspr FEDORA-2019-e4c45e113c

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-4450

IBM i 7.2, 7.3, and 7.4 for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163492...

CVE-2019-4450

IBM i 7.2, 7.3, and 7.4 for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163492...

Cross site scripting

IBM i 7.2, 7.3, and 7.4 for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163492...

CVE-2019-4450

CVE-2019-4450 affects IBM i 7.2, 7.3, and 7.4 for i via IBM Navigator for i. The issue is a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. IBM IBM i has addressed ...

[SECURITY] Fedora 30 Update: nspr-4.23.0-1.fc30

NSPR provides platform independence for non-GUI operating system facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval timing and calendar time, basic memory management malloc and free and shared library linking...

[SECURITY] Fedora 31 Update: nspr-4.23.0-1.fc31

NSPR provides platform independence for non-GUI operating system facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval timing and calendar time, basic memory management malloc and free and shared library linking...

Code Injection in mateodelnorte/meta-git

Description The meta-git module is vulnerable against command injection since the user-supplied inputs are concatenated with a command which is executed without validation. POC 1. Create a new directory and insert some test files: bash mkdir tests cd tests touch test touch secret touch files 2...

IBM Navigator for i Cross-Site Scripting Vulnerability (CNVD-2019-39762)

IBM Navigator for i is a console interface used in IBMi for performing and managing critical tasks in IBMi from IBM USA. A cross-site scripting vulnerability exists in IBM Navigator for i, which can be exploited by remote attackers to inject arbitrary JavaScript code into the Web UI...

File upload vulnerability in 5iSNS content payment system

5iSNS Labs is dedicated to providing a source code for webmasters, with a new version of the system, covering features such as libraries and posts. A file upload vulnerability exists in the 5iSNS content payment system, which can be exploited by an attacker to obtain webmaster privileges...

SQL injection vulnerability in the i*** parameter of the pr***.php page of the Suzhou Topps website builder system

Suzhou Topps Network Technology Co., Ltd. is a network company that provides website construction and promotion services. Suzhou Topps Web site building system pr.php page i parameters exist SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

SUSE SLES12 Security Update : sudo (SUSE-SU-2019:2668-1)

This update for sudo provides the following fix : Security issue fixed : CVE-2019-14287: Fixed an issue where a user with sudo privileges that allowed them to run commands with an arbitrary uid, could run commands as root, despite being forbidden to do so in sudoers bsc1153674. Other issues fixed...

SUSE-RU-2019:2677-1 Recommended update for e2fsprogs

This update for e2fsprogs fixes the following issues: Security issue fixed: - CVE-2019-5094: Fixed an arbitrary code execution via specially crafted ext4 file systems. bsc1152101 Non-security issue fixed: - libext2fs: Call fsync2 to clear stale errors for a new a unix I/O channel. bsc1145716...

Siemens Industrial Products Local Privilege Escalation Vulnerability (Update I)

1. EXECUTIVE SUMMARY CVSS v3 6.4 ATTENTION: Exploitable locally Vendor: Siemens Equipment: Industrial Products Vulnerability: Improper privilege management 2. UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-16-313-02 Siemens Industrial Products Local...