PT-2019-16465

Name of the Vulnerable Software and Affected Versions Oracle FLEXCUBE Universal Banking versions 12.0.1 through 12.4.0 Oracle FLEXCUBE Universal Banking versions 14.0.0 through 14.2.0 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCU...

PT-2019-16536

Name of the Vulnerable Software and Affected Versions Oracle FLEXCUBE Investor Servicing versions 12.0.1, 12.0.3, 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0 Description The issue allows a low-privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Investor Servicing...

Oracle MySQL Server Component Access Control Error Vulnerability (CNVD-2019-26533)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. An Access Control Error vulnerability exists in the InnoDB component of the MySQL Server component in Oracle MySQL, version 8.0.16 and earlier. An...

Insert or Embed Articulate Content into WordPress plugin <= 4.2998 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability found in Insert or Embed Articulate Content into WordPress plugin versions = 4.2998. Solution Update the Insert or Embed Articulate Content into WordPress plugin to the latest available version at least 4.2999...

The vulnerability in the implementation of the ips_init_phase1 function in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability in the implementation of the ipsinitphase1 function, which is called from the ipsinsertdevice handler in the loaded module drivers/scsi/ips.ko of the Linux operating system, stems from a memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

WordPress plugin Insert or Embed Articulate Content into WordPress remote code execution vulnerability (CNVD-2019-22391)

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A remote code execution vulnerability exists in the WordPress plugin Insert or Embed...

PT-2019-13002

Name of the Vulnerable Software and Affected Versions RedwoodHQ version 2.5.5 Description The issue allows remote attackers to create admin users without requiring any authentication for database operations. This can be achieved via a con.automationframework users insert one call. Recommendations...

Cross-Site Request Forgery (CSRF)

phpMyAdmin is vulnerable to cross-site request forgery CSRF. The readCredentials function in AuthenticationCookie plugin uses $REQUEST instead of $POST. This allows an attacker to trick a user and deliver malicious payload, through statements such as INSERT or DELETE, to the victim...

UBUNTU-CVE-2019-12616

An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potential...

CVE-2019-12616

An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potential...

PT-2019-12893

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.9.0 Description A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's...

CVE-2019-12616: Cross-Site Request Forgery (CSRF)

An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potential...

UBUNTU-CVE-2019-12379

An issue was discovered in coninsertunipair in drivers/tty/vt/consolemap.c in the Linux kernel through 5.1.5. There is a memory leak in a certain case of an ENOMEM outcome of kmalloc. NOTE: This id is disputed as not being an issue...

PT-2019-6460

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.1.5 Description The issue is related to the con insert unipair function in the drivers/tty/vt/consolemap.c component of the Linux kernel, which is associated with incorrect memory deallocation before removing th...

Privilege Escalation

PostgreSQL is vulnerable to privilege escalation vulnerability. This is because INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL. A low privileged attacker without full read access but with both INSERT and UPDATE access could read the sensitive information of the table contents...

Authorization Bypass

Postgresql is vulnerable to authorization bypass vulnerability. This is because PostgreSQL fails to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE", certain "INSERT" and limited "UPDATE" privileges to a particula...

Privilege Escalation

MySQL is vulnerable privilege escalation vulnerability. A low privileged attacker with network access via multiple protocols could compromise MySQL Server resulting in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a...

PostgreSQL memory leak vulnerability (CNVD-2019-16482)

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. There is a security vulnerability in PostgreSQL. An attacker can...

Vulnerability in core server (CVE-2019-10129)

Memory disclosure in partition routing Prior to this release, a user running PostgreSQL 11 can read arbitrary bytes of server memory by executing a purpose-crafted INSERT statement to a partitioned table...

PostgreSQL -- Memory disclosure in partition routing

The PostgreSQL project reports: Prior to this release, a user running PostgreSQL 11 can read arbitrary bytes of server memory by executing a purpose-crafted INSERT statement to a partitioned table...