Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Intelligent Operations Center (CVE-2019-4270)

Summary IBM WebSphere Application Server is shipped with IBM Intelligent Operations Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bulletin, Security Bulletin:...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Intelligent Operations Center (CVE-2019-4268)

Summary IBM WebSphere Application Server is shipped with IBM Intelligent Operations Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bulletin, Security Bulletin: File...

bd.thesciencejob.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-973199 Security Researcher garletmarco Helped patch 1540 vulnerabilities Received 4 Coordinated Disclosure badges , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting bd.thesciencejob.com website and its users. Followi...

CVE-2019-16256

Some Samsung devices include the SIMalliance Toolbox Browser aka S@T Browser on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit STK instructions in an SMS message, aka Simjacker...

ffmpeg:ffmpeg_AV_CODEC_ID_THP_fuzzer: Heap-buffer-overflow in ljpeg_decode_rgb_scan

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5763147314495488 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDTHPfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

Security update for chromium (moderate)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2019:2080-1 Rating: moderate References: 1146219 1149143 Cross-References: CVE-2019-5869 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has one errata is now available...

Security update for python-SQLAlchemy (important)

openSUSE Security Update: Security update for python-SQLAlchemy Announcement ID: openSUSE-SU-2019:2064-1 Rating: important References: 1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now available. Description...

Security update for python-SQLAlchemy (important)

openSUSE Security Update: Security update for python-SQLAlchemy Announcement ID: openSUSE-SU-2019:2039-1 Rating: important References: 1124593 Cross-References: CVE-2019-7164 CVE-2019-7548 Affected Products: openSUSE Leap 15.0 An update that fixes two vulnerabilities is now available. Description...

How to Upgrade to License Server 11.x on Windows 2008

This article describes how to upgrade Citrix License server to 11.10 and 11.11.1 on a Windows 2008 Server...

Talos DEFCON badge build instructions and use

By Patrick Mullen. We want to thank everyone who stopped by the Cisco Talos booth at DEFCON's Blue Team Village earlier this month. We handed out these badges at our area where we had Snort rules challenges, reverse-Capture the Flag and recruiters ready to answer attendees' career advice question...

Buffer overflow

An issue was discovered in the Texas Instruments TI TM4C, MSP432E and MSP432P microcontroller series. The eXecute-Only-Memory XOM implementation prevents code read-outs on protected memory by generating bus faults. However, single-stepping and using breakpoints is allowed in XOM-protected flash...

libvips:jpegsave_buffer_fuzzer: Heap-buffer-overflow in attach_xmp_blob

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5673786296238080 Project: libvips Fuzzing Engine: afl Fuzz Target: jpegsavebufferfuzzer Job Type: aflasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

Amazon Linux 2 : kernel (ALAS-2019-1253)

There is a newly discovered variant side-channel attack of Spectre V1 which leverages SWAPGS instructions to bypass KPTI/KVA mitigations. This could lead to a kernel information disclosure. CVE-2019-1125 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Amazon Linux AMI : kernel (ALAS-2019-1253)

There is a newly discovered variant side-channel attack of Spectre V1 which leverages SWAPGS instructions to bypass KPTI/KVA mitigations. This could lead to a kernel information disclosure C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2019:1849-1 Rating: important References: 1143492 1144625 Cross-References: CVE-2019-5850 CVE-2019-5851 CVE-2019-5852 CVE-2019-5853 CVE-2019-5854 CVE-2019-5855 CVE-2019-5856 CVE-2019-5857 CVE-2019-5858 CVE-2019-58...

NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0137)

The remote NewStart CGSL host, running version MAIN 4.05, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities: - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions a...

U.S. Dept Of Defense: Account takeover through CSRF in http://███████/██████████/default.asp

Summary: Hi team, I have found a CSRF vulnerability in http://██████/████/default.asp that leads to account takeover. Step-by-step Reproduction Instructions 1. Go to http://██████████/████████/default.asp and login 2. Copy the below HTML code 3. Submit the request and see your profile 4. Try to...

How to locate and download Citrix Workspace App

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149 for more information. Assist with locating and downloading the latest or earlier versions of Citrix Workspace App or Citrix...

Kernel: KVM: leak of uninitialized stack contents to guest

An information leakage issue was found in the way Linux kernel's KVM hypervisor handled page fault exceptions while emulating instructions like VMXON, VMCLEAR, VMPTRLD, and VMWRITE with memory address as an operand. It occurs if the operand is a mmio address, as the returned exception object hold...

Medium: kernel

Issue Overview: There is a newly discovered variant side-channel attack of Spectre V1 which leverages SWAPGS instructions to bypass KPTI/KVA mitigations. This could lead to a kernel information disclosure Affected Packages: kernel Issue Correction: Run yum update kernel or yum update --advisory...